Resource exhaustion in Node.js Node
CVE-2026-21637
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.011 (65.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 65th percentile — 65.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: +0.000
Affected products
- Node.js Node — versions 20.19.6, 22.21.1, 24.12.0
- Node.js
Weakness classification (CWE)
References
- nodejs.org/en/blog/vulnerability/december-2025-security-releases (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-21637?
- CVE-2026-21637 is a high-severity vulnerability in Node.js Node, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-01-20.
- How severe is CVE-2026-21637?
- High severity. CVSS v3 base score is 7.5 out of 10.