CVE-2026-21637: 
vulnerability analysis and mitigation

CVE-2026-21637 is a denial-of-service vulnerability in Node.js TLS error handling, specifically affecting servers that use pskCallback (Pre-Shared Key) or ALPNCallback (Application-Layer Protocol Negotiation) callbacks. Synchronous exceptions thrown within these callbacks bypass the standard TLS error handling paths (tlsClientError and error events), resulting in either immediate process termination or silent file descriptor leaks that accumulate until the service becomes unavailable. The vulnerability was reported via HackerOne by researcher 0xmaxhax and disclosed on January 20, 2026, with fixes released on January 13, 2026 as part of Node.js's December 2025 security release cycle. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, though the CNA (HackerOne) scored it 5.9 (Medium) (Node.js Advisory, NVD).

The root cause is an uncaught exception (CWE-248) leading to uncontrolled resource consumption (CWE-400) in Node.js's TLS implementation (_tls_wrap.js). When pskCallback or ALPNCallback are registered on a TLS server, synchronous exceptions thrown inside these callbacks are not wrapped in try-catch blocks, causing them to escape the normal TLS error handling flow. This means the tlsClientError and error events — which would normally allow application-level error recovery — are never emitted. The result is either an uncaught exception that terminates the Node.js process immediately, or a file descriptor leak where the underlying socket is not properly closed, eventually exhausting the OS file descriptor limit. Because these callbacks receive and process attacker-controlled data (e.g., PSK identity hints or ALPN protocol strings) during the TLS handshake, a remote unauthenticated client can repeatedly trigger the flaw. A follow-up incomplete fix was also noted: loadSNI() in _tls_wrap.js similarly lacked a try-catch, addressed in the March 2026 security release (Node.js Advisory, Node.js March Release).

Successful exploitation allows an unauthenticated remote attacker to crash a Node.js TLS server or exhaust its file descriptors, causing a complete denial of service for all users of the affected application. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Applications using PSK-based mutual authentication or ALPN-based protocol negotiation (common in custom TLS servers, IoT backends, and microservices) are directly at risk, and repeated exploitation can render the service permanently unavailable until the process is restarted or file descriptor limits are reset (Node.js Advisory, Feedly).

No public proof-of-concept exploit code has been confirmed, though exploitation has been reported by various sources including undercodetesting.com, and the vulnerability is considered exploitable in the wild (Feedly). The attack requires no authentication, no user interaction, and low complexity — an attacker simply needs to initiate a TLS handshake with a server using the affected callbacks and trigger a synchronous exception. The EPSS score is approximately 0.02% (0.000200), indicating a currently low probability of widespread automated exploitation. The vulnerability is not listed in the CISA KEV catalog as of the time of this report. It has been detected by both Nessus and Qualys scanners across numerous plugin IDs, indicating broad scanner coverage (Feedly).

1. Reconnaissance: Identify internet-facing Node.js TLS servers using tools like Shodan or Censys, looking for services that advertise PSK or ALPN TLS extensions during the handshake (e.g., via openssl s_client -connect <host>:<port> -alpn <protocol>).
2. Confirm callback usage: Attempt a TLS handshake with a crafted PSK identity or ALPN protocol string. Servers using pskCallback will respond to PSK-based ClientHello messages; servers using ALPNCallback will process ALPN extension data.
3. Trigger synchronous exception: Send a TLS ClientHello with a PSK identity or ALPN value crafted to cause the server-side callback to throw a synchronous exception (e.g., an unexpected format, null value, or value that triggers application-level validation logic inside the callback).
4. Observe impact: If the server process crashes (immediate termination), subsequent connection attempts will fail. If file descriptors are leaking silently, repeated connections over time will exhaust the server's FD limit, eventually causing EMFILE errors and service unavailability.
5. Repeat for sustained DoS: Automate the handshake attempts in a loop to continuously trigger the flaw, either crashing the process repeatedly or accelerating FD exhaustion (Node.js Advisory, Feedly).

• Logs: Node.js process logs showing uncaught exception stack traces originating from _tls_wrap.js or TLS callback functions; repeated EMFILE: too many open files errors in application or system logs; sudden process exit with no graceful shutdown message.
• Network: High volume of incomplete TLS handshakes from one or more source IPs; connections that initiate but never complete the handshake (visible in network captures or firewall logs); unusual PSK identity strings or malformed ALPN values in TLS ClientHello packets.
• Process/System: Rapid increase in open file descriptor count for the Node.js process (observable via lsof -p <pid> | wc -l or /proc/<pid>/fd); Node.js process restarting unexpectedly or being respawned by a process manager (e.g., PM2, systemd) at unusual frequency.
• OS Metrics: System-level file descriptor exhaustion alerts; ulimit -n thresholds being approached or exceeded for the Node.js process user (Node.js Advisory).

The primary remediation is to upgrade Node.js to a patched version: 20.20.0, 22.22.0, 24.13.0, or 25.3.0 (or later). A follow-up patch addressing an incomplete fix in loadSNI() was released in the March 2026 security release (versions 20.20.2, 22.22.2, 24.13.1, 25.8.2). As a workaround, developers should wrap all logic inside pskCallback and ALPNCallback with try-catch blocks to prevent synchronous exceptions from escaping. Red Hat has issued multiple errata (RHSA-2026:1842, 1843, 2420–2422, 2781–2783, 7350, 7670, 7675) for RHEL 8, 9, and 10; Oracle, IBM, Microsoft (Visual Studio 2019/2022), Debian, SUSE, and other vendors have also released patches. Organizations unable to patch immediately should consider placing TLS servers behind a load balancer or proxy that can absorb malformed handshakes (Node.js Advisory, Node.js March Release, Red Hat Bugzilla).

The Node.js security team credited researcher 0xmaxhax for the report and mcollina for the fix, and classified the vulnerability as Medium severity in their advisory (Node.js Advisory). NVD independently scored it higher at 7.5 (High), reflecting the unauthenticated, network-exploitable nature of the flaw. Security news outlets including CyberSecurityNews, GBHackers, CyberPress, and The Cyber Express covered the broader Node.js December 2025 security release, highlighting CVE-2026-21637 alongside other DoS vulnerabilities. Microsoft included the CVE in its April 2026 Patch Tuesday, noting that Visual Studio 2019 and 2022 incorporate Node.js and are affected, which drew additional coverage from BleepingComputer and Rapid7 (Microsoft MSRC, Oracle CPU). The security community on Reddit (r/SecOpsDaily) and LinkedIn discussed the vulnerability in the context of Node.js TLS hardening best practices.