Loading vulnerability…
CVE-2026-21637 is a denial-of-service vulnerability in Node.js TLS server error handling. The flaw occurs when TLS handshake callbacks such as pskCallback or ALPNCallback process attacker-controlled input and throw synchronous exceptions that are not safely contained by the TLS error-handling path. Reported descriptions also indicate the same class of issue affected SNICallback handling in the loadSNI() path of _tls_wrap.js, where missing try/catch protection allowed exceptions to bypass normal tlsClientError and error handling. As a result, malformed or unexpected handshake input can propagate as an uncaught exception, terminating the Node.js process, or can trigger cleanup failures that leak file descriptors over repeated connections. The vulnerability affects Node.js TLS servers in affected 20.x, 22.x, 24.x, and 25.x release lines when these callback paths are enabled and capable of throwing.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
pskCallback and ALPNCallback, and any callback path that may throw during handshake processing. Refactor callback implementations so they do not throw synchronously on malformed or unexpected input; instead, catch and handle errors internally. Additional operational mitigations such as connection throttling, handshake rate limiting, and resource limits can reduce the effectiveness of repeated remote triggering, but they do not fully remediate the flaw.Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A non-Microsoft-issued CVE impacting Node.js, mentioned as included among the addressed flaws.
A Node.js TLS-layer improper exception handling vulnerability involving loadSNI()/SNICallback that can cause an uncaught exception and remote denial of service; the article describes this as an incomplete fix scenario.
A high-severity Node.js TLS error-handling flaw in SNICallback that can be triggered remotely without authentication to crash the Node.js process.
Medium-severity issue in Node.js TLS where PSK/ALPN callback exceptions can crash servers (DoS) or leak file descriptors.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.