Loading vulnerability…
Node.js TLS Callback Exception Denial of Service
CVE-2026-21637 is an improper exception-handling vulnerability in Node.js TLS server processing. On affected TLS servers that use pskCallback or ALPNCallback, a synchronous exception raised while processing attacker-controlled TLS-handshake input can bypass normal TLS error-handling paths. The resulting unhandled condition can terminate the Node.js process or leak file descriptors, enabling remote denial of service through repeated handshake attempts.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can repeatedly trigger callback exceptions to crash an affected Node.js TLS server immediately or exhaust file descriptors through leaked resources. Either outcome can deny TLS service. No confidentiality or integrity impact is stated.
If you can’t patch tonight, do this now.
Until patched versions are deployed, avoid using pskCallback and ALPNCallback in internet-accessible TLS servers where feasible. Where callbacks are required, ensure their implementations catch and handle synchronous exceptions and validate handshake input without allowing exceptions to escape. Apply TLS handshake connection limits or rate limiting, enforce process and file-descriptor resource limits, and monitor for abnormal process termination and file-descriptor consumption.
Patch, then assume compromise.
Install vendor-provided Node.js updates. Fixed SUSE package streams include Node.js 18.20.8, 20.20.2, 22.22.2 or 22.23.0, 24.14.1, and 26.3.1, subject to distribution-specific package release suffixes. For the active Node.js release lines, upgrade to v20.20.2, v22.22.2, v24.14.1, or v25.8.2, or later applicable maintenance releases.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.