CVE-2025-70043
Published: 23 February 2026
Summary
CVE-2025-70043 is a critical-severity Improper Certificate Validation (CWE-295) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 8.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SC-8 (Transmission Confidentiality and Integrity).
Deeper analysis
CVE-2025-2025-70043, published on 2026-02-23, is a critical vulnerability (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) corresponding to CWE-295: Improper Certificate Validation in the master branch of Ayms node-To. This Node.js application or module, hosted under the Ayms GitHub organization, disables TLS/SSL certificate validation by explicitly setting the 'rejectUnauthorized' option to false in its TLS socket configurations, allowing connections to servers with invalid or untrusted certificates.
The vulnerability enables remote attackers with network access to exploit it with low complexity, no required privileges, and no user interaction. Exploitation facilitates man-in-the-middle attacks, granting high confidentiality and integrity impacts, such as intercepting sensitive data in transit or injecting malicious content into otherwise encrypted communications.
Mitigation details are available in the referenced sources, including the GitHub repositories at https://github.com/Ayms and https://github.com/Ayms/node-To, as well as the advisory gist at https://gist.github.com/zcxlighthouse/33cc4342dfe650664548b4531d16b655.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207647
Vulnerability details
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in TLS socket options
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables MITM attacks via disabled TLS certificate validation (CWE-295).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and management of public key infrastructure certificates, directly preventing acceptance of invalid or untrusted certificates in TLS connections exploited by this CVE.
Mandates cryptographic protection for transmission confidentiality and integrity, which comprehensively addresses the improper TLS certificate validation enabling MITM attacks.
Requires identification, reporting, and timely remediation of system flaws, directly mitigating the hardcoded 'rejectUnauthorized: false' vulnerability in the Node.js application.