A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in… (CVE-2026-21637)
A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when using pskCallback or ALPNCallback. Synchronous exceptions thrown during these callbacks bypass normal TLS error handling, causing process termination or resource leaks leading to denial of service. This affects multiple Node.js versions where these callbacks are not safely wrapped.
AI Analysis
Technical Summary
CVE-2026-21637 is a high-severity vulnerability in Node.js TLS servers that use pskCallback or ALPNCallback. When these callbacks throw synchronous exceptions, the exceptions bypass the standard TLS error handling mechanisms (tlsClientError and error events). This can cause immediate termination of the Node.js process or silent leaks of file descriptors, which eventually exhaust server resources and cause denial of service. Because these callbacks handle attacker-controlled input during the TLS handshake, a remote attacker can repeatedly trigger this flaw to crash or degrade the TLS server. The vulnerability affects Node.js versions <20.20.0, >=21.0.0 <22.22.0, >=23.0.0 <24.13.0, and >=25.0.0 <25.3.0. A patch is available to address this issue.
Potential Impact
Remote attackers can cause denial of service on affected Node.js TLS servers by triggering synchronous exceptions in pskCallback or ALPNCallback during the TLS handshake. This can lead to immediate process crashes or resource exhaustion through file descriptor leaks, disrupting service availability.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to fixed Node.js versions beyond the affected ranges to remediate the issue. No additional mitigation is indicated beyond applying the official fix.
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in… (CVE-2026-21637)
Description
A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when using pskCallback or ALPNCallback. Synchronous exceptions thrown during these callbacks bypass normal TLS error handling, causing process termination or resource leaks leading to denial of service. This affects multiple Node.js versions where these callbacks are not safely wrapped.
Affected software
pkg:bitnami/nodeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-21637 is a high-severity vulnerability in Node.js TLS servers that use pskCallback or ALPNCallback. When these callbacks throw synchronous exceptions, the exceptions bypass the standard TLS error handling mechanisms (tlsClientError and error events). This can cause immediate termination of the Node.js process or silent leaks of file descriptors, which eventually exhaust server resources and cause denial of service. Because these callbacks handle attacker-controlled input during the TLS handshake, a remote attacker can repeatedly trigger this flaw to crash or degrade the TLS server. The vulnerability affects Node.js versions <20.20.0, >=21.0.0 <22.22.0, >=23.0.0 <24.13.0, and >=25.0.0 <25.3.0. A patch is available to address this issue.
Potential Impact
Remote attackers can cause denial of service on affected Node.js TLS servers by triggering synchronous exceptions in pskCallback or ALPNCallback during the TLS handshake. This can lead to immediate process crashes or resource exhaustion through file descriptor leaks, disrupting service availability.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to fixed Node.js versions beyond the affected ranges to remediate the issue. No additional mitigation is indicated beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-node-2026-21637
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-21637"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- State
- PUBLISHED
Threat ID: 6aa005faacd9273b49ab689f
Added to database: 09/08/2026, 12:56:26 UTC
Last enriched: 09/08/2026, 13:36:18 UTC
Last updated: 09/10/2026, 22:22:37 UTC
Views: 29
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.