CVE-2026-21637 in Node.js 22.16.0

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client ca

Severity

High 7.5

Exploitation

1% chance of exploit
in the next 30 days

Fix

Update to 22.22.0, 24.13.0, 25.3.0

Where

App / API

How it matched

Exact version match

First seen

2026-11-05 01:13:58 UTC

Source

https://nvd.nist.gov/vuln/detail/CVE-2026-21637