CVE-2026-21637

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.

• CWE-400

• https://nodejs.org/en/blog/vulnerability/december-2025-security-releasesRelease Notes, Vendor Advisory

Published

Jan 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21631Lack of output escaping leads to a XSS vector in the multili…5.4
• CVE-2026-21632Lack of output escaping for article titles leads to XSS vect…5.4
• CVE-2026-21633A malicious actor with access to the adjacent network could …8.8
• CVE-2026-21634A malicious actor with access to the adjacent network could …6.5
• CVE-2026-21635An Improper Access Control could allow a malicious actor in …6.5
• CVE-2026-21636A flaw in Node.js's permission model allows Unix Domain Sock…10
• CVE-2026-21638A malicious actor in Wi-Fi range of the affected product cou…8.8
• CVE-2026-21639A malicious actor in Wi-Fi range of the affected product cou…8.8
• CVE-2026-2164A security flaw has been discovered in detronetdip E-commerc…9.8
• CVE-2026-21640HackerOne community member Faraz Ahmed (PakCyberbot) has rep…2.7
• CVE-2026-21641HackerOne community member Jad Ghamloush (0xjad) has reporte…6.5
• CVE-2026-21642HackerOne community member Patrick Lang (7yr) has reported a…6.1