https: distinguish PFX object-array agent keys

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#930
Refs: https://hackerone.com/reports/3816840
CVE-ID: CVE-2026-56850

Author: RafaelGSS

lib/https.js

@@ -22,6 +22,7 @@
 'use strict';
 
 const{
+ ArrayIsArray,
  ArrayPrototypeIndexOf,
  ArrayPrototypePush,
  ArrayPrototypeShift,
@@ -467,6 +468,20 @@ ObjectSetPrototypeOf(Agent.prototype, HttpAgent.prototype);
 ObjectSetPrototypeOf(Agent,HttpAgent);
 Agent.prototype.createConnection=createConnection;
 
+functiongetPfxAgentKey(pfx,passphrase){
+if(!ArrayIsArray(pfx))
+returnpfx;
+
+letkey='';
+for(leti=0;i<pfx.length;i++){
+constvalue=pfx[i];
+constraw=value?.buf||value;
+constpass=value?.passphrase||passphrase;
+key+=`:${raw}:${pass}`;
+}
+returnkey;
+}
+
 /**
  * Gets a unique name for a set of options.
  * @param {{
@@ -502,7 +517,7 @@ Agent.prototype.getName = function getName(options = kEmptyObject) {
 
 name+=':';
 if(options.pfx)
-name+=options.pfx;
+name+=getPfxAgentKey(options.pfx,options.passphrase);
 
 name+=':';
 if(options.rejectUnauthorized!==undefined)

test/parallel/test-https-agent-getname.js

@@ -6,6 +6,7 @@ if (!common.hasCrypto)
 
 constassert=require('assert');
 consthttps=require('https');
+constfixtures=require('../common/fixtures');
 
 constagent=newhttps.Agent();
 
@@ -52,3 +53,46 @@ assert.strictEqual(
 '::secureProtocol:c,r,l:false:ecdhCurve:dhparam:0:sessionIdContext:'+
 '"sigalgs":privateKeyIdentifier:privateKeyEngine'
 );
+
+{
+constbaseOptions={
+host: '0.0.0.0',
+port: 443,
+};
+
+constagent1=fixtures.readKey('agent1.pfx');
+constagent6=fixtures.readKey('agent6.pfx');
+
+assert.notStrictEqual(
+agent.getName({
+ ...baseOptions,
+pfx: [{buf: agent1,passphrase: 'sample'}],
+}),
+agent.getName({
+ ...baseOptions,
+pfx: [{buf: agent6,passphrase: 'sample'}],
+})
+);
+
+assert.notStrictEqual(
+agent.getName({
+ ...baseOptions,
+pfx: [{buf: agent1,passphrase: 'sample'}],
+}),
+agent.getName({
+ ...baseOptions,
+pfx: [{buf: agent1,passphrase: 'different'}],
+})
+);
+
+assert.notStrictEqual(
+agent.getName({
+ ...baseOptions,
+pfx: [{__proto__: {buf: agent1,passphrase: 'sample'}}],
+}),
+agent.getName({
+ ...baseOptions,
+pfx: [{__proto__: {buf: agent6,passphrase: 'sample'}}],
+})
+);
+}

test/parallel/test-https-agent-pfx-object-array-reuse.js

@@ -0,0 +1,59 @@
+'use strict';
+
+constcommon=require('../common');
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+constassert=require('assert');
+consthttps=require('https');
+constfixtures=require('../common/fixtures');
+
+constserver=https.createServer({
+key: fixtures.readKey('agent2-key.pem'),
+cert: fixtures.readKey('agent2-cert.pem'),
+requestCert: true,
+rejectUnauthorized: false,
+},common.mustCall((req,res)=>{
+res.end(req.socket.getPeerCertificate().subject.CN);
+},2));
+
+server.listen(0,common.mustCall(async()=>{
+constagent=newhttps.Agent({keepAlive: true,maxSockets: 1});
+constport=server.address().port;
+
+constfirst=awaitrequest({
+ agent,
+ port,
+pfx: [{buf: fixtures.readKey('agent1.pfx'),passphrase: 'sample'}],
+});
+assert.strictEqual(first.body,'agent1');
+assert.strictEqual(first.reusedSocket,false);
+
+constsecond=awaitrequest({
+ agent,
+ port,
+pfx: [{buf: fixtures.readKey('agent10.pfx'),passphrase: 'sample'}],
+});
+assert.strictEqual(second.body,'agent10.example.com');
+assert.strictEqual(second.reusedSocket,false);
+
+agent.destroy();
+server.close();
+}));
+
+functionrequest(options){
+returnnewPromise((resolve,reject)=>{
+constreq=https.get({
+ ...options,
+rejectUnauthorized: false,
+},common.mustCall((res)=>{
+letbody='';
+res.setEncoding('utf8');
+res.on('data',(chunk)=>body+=chunk);
+res.on('end',common.mustCall(()=>{
+resolve({ body,reusedSocket: req.reusedSocket});
+}));
+}));
+req.on('error',reject);
+});
+}