Search: CVE-2026-21637

CVE-2026-21637 is a medium severity vulnerability in Node.js TLS error handling affecting multiple versions. It arises when synchronous exceptions thrown in PSK or ALPN callbacks during the TLS handshake bypass normal error handling, causing either immediate process termination or silent resource leaks. Remote attackers can exploit this by sending crafted TLS handshake requests, leading to denial of service through server crashes or resource exhaustion. No authentication or user interaction is required, and the flaw impacts TLS servers using these callbacks. Although no known exploits are reported in the wild yet, the vulnerability affects a wide range of Node.js versions, including recent releases. The CVSS score is 5.9, reflecting a moderate risk primarily to availability. European organizations running Node.