Node.js: Remotely triggerable uncaught exception in TLS servers
Summary
Node.js TLS servers that use the SNICallback, OCSPRequest, newSession or resumeSession hooks, or server.addContext(), are affected. A remote, unauthenticated attacker can send a crafted TLS client hello followed by padding and a socket FIN, so the socket is destroyed before a deferred callback runs. The Node.js process then crashes with an uncaught exception, which causes a denial of service. Data is not exposed.
Affected
- Node.js 24.0.0 to before 24.22.3 (CNA record)
- Node.js 25.0.0 to before 26.13.1 (CNA record; the 25.x line is listed by the CNA but not named in the advisory excerpts)
- Node.js 26.x and 24.x per the CVE description
- Node.js 22.x: unconfirmed, check the vendor advisory
- Default configuration is unaffected according to the CNA record; the trigger requires one of the listed hooks
Fixed in
- Node.js 24.22.3
- Node.js 26.13.1
Workaround
- No vendor-documented workaround found.
- Interim measure, not vendor-sourced: place a TLS-terminating reverse proxy or load balancer in front of Node.js so that raw client handshakes do not reach the Node.js TLS stack. Verify this for your setup.
- Check whether your applications use SNICallback, OCSP, session hooks or server.addContext(); these are the trigger conditions.
Exploitation
- No exploitation in the wild reported as of 11 November 2026.
- Not listed in the CISA KEV catalog.
- No public proof of concept found at the time of research.
- The CNA description explains the crash mechanism in detail, which may lower the effort for a proof of concept.
Our recommendation
- Inventory all Node.js runtimes and versions (node -v), including containers and CI images.
- Upgrade internet-facing Node.js 24.x services to 24.22.3 or later, and 26.x services to 26.13.1 or later.
- Upgrade 22.x services to 22.23.5 or later as a precaution, as 22.x was patched in the same release batch.
- Restart services after the upgrade, as a running process keeps the old code loaded.
- Monitor for unexpected Node.js process restarts or crash logs until patching is complete.
- Expect further TLS-callback fixes in Node.js and keep the runtime on a regular patch cycle.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenJS CNA Security Advisories cna.openjsf.org
- Node.js Security Releases, 11 November 2026 nodejs.org
- Node.js 26.13.1 release notes nodejs.org
- OffSeq Radar: CVE-2026-126051 radar.offseq.com
- Strix: CVE-2026-126051 www.strix.ai
- VulDB: CVE-2026-126051 vuldb.com
- SecurityOnline: Node.js HTTP/2 and TLS vulnerabilities, November 2026 securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:34.
Original description (NVD)
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.