A use-after-destroy vulnerability exists in Node.js TLS server handshake handling when using certain OpenSSL callbacks. This flaw allows a remote, unauthenticated attacker to cause the Node.js server process to terminate unexpectedly by sending a specially crafted client hello message followed by a socket FIN. The issue affects Node.js versions 24.x and 26.x and results in an uncaught exception that crashes the server process.