CVE-2026-21637
Node.js: exceptions in TLS PSK, ALPN and SNI callbacks crash the server
Technology
Node.js
CVSS Score
7.5 / 10.0
Affected Versions
>=4.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0
Upstream Fix
20.20.0; 22.22.0; 24.13.0; 25.3.0; SNICallback case completed in 20.20.2; 22.22.2; 24.14.1; 25.8.2
Published
January 20, 2026
OSSeva Coverage
Fixed upstream
Description
Synchronous exceptions thrown in pskCallback or ALPNCallback bypass TLS error handling, causing process termination or file descriptor leaks that a remote client can trigger repeatedly. Fixed in January 2026 (20.20.0, 22.22.0, 24.13.0, 25.3.0). The fix missed SNICallback, which the March 2026 releases (20.20.2, 22.22.2, 24.14.1, 25.8.2) completed under the same CVE and rated High. NVD's version range starts at 4.0.0, so end-of-life lines are flagged.
Is your Node.js deployment affected?
If you're running >=4.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0, you need this patch. Book a discovery call to get covered.
Get a quote
Running Node.js >=4.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?