AIKIDO-2026-171454

TL;DR

Affected versions of the package are vulnerable to incorrect mutual TLS (mTLS) client identity reuse in the HTTPS Agent. When options.pfx is supplied as an array of objects (for example [{ buf, passphrase }]), Agent.prototype.getName stringifies the array in a way that does not distinguish different certificates or passphrases, producing colliding agent connection keys. As a result, keep-alive connections authenticated with one client certificate can be reused for requests configured with a different PFX, causing the wrong mTLS identity to be presented to the remote server. The fix computes a stable PFX-specific agent key that incorporates each buffer and passphrase.