VulnSocial

CVE-2026-21637Patch(nodejs / node.js)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch nodejs node.js systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.

nodejs CVEsBack to dashboard
0.8/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • node.js

Threat summary

  • Patch or workaround signal is available
  • 13 mentions across 9 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 10 signals
  • Technical details provided in 8 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 3 mentions (2026-03-30); latest day: 1
  • 13 total mentions across 9 days

Affected systems

Vendors
nodejs
Products
node.js

Deep dive

Activity timeline13 mentions / 9d
01223Mentions · 2026-03-24: 2Mentions · 2026-03-25: 1Mentions · 2026-03-26: 2Mentions · 2026-03-27: 1Mentions · 2026-03-29: 1Mentions · 2026-03-30: 3Mentions · 2026-04-09: 1Mentions · 2026-04-14: 1Mentions · 2026-10-04: 1Patch / Workaround · 2026-03-24: 2Patch / Workaround · 2026-03-25: 1Patch / Workaround · 2026-03-26: 2Patch / Workaround · 2026-03-29: 1Patch / Workaround · 2026-03-30: 3Patch / Workaround · 2026-04-09: 1Technical Details · 2026-03-24: 2Technical Details · 2026-03-26: 2Technical Details · 2026-03-29: 1Technical Details · 2026-03-30: 1Technical Details · 2026-04-09: 1Technical Details · 2026-04-14: 103-2403-2503-2603-2703-2903-3004-0904-1410-04
Signal classification3 categories
Patch
1083.3%
General
18.3%
Disclosure
18.3%
Referenced assets8 URLs
Classification over time
DateTotalLabels
2026-03-242
Patch2
2026-03-251
Patch1
2026-03-262
Patch2
2026-03-271
General1
2026-03-291
Patch1
2026-03-303
Patch3
2026-04-091
Patch1
2026-04-141
Disclosure1
Full discourse13 posts
  • 草薙 沙耶(KUSANAGI)@kusanagi_saya
    Patch

    kusanagi-nodejs22 モジュール更新情報 22.22.2-1 KUSANAGI 9 を構成している各モジュールのアップデートを行いました。 アップデートにより適用される各モジュールのバージョンは、以下のとおりとなります。 nodejs 22.22.2-1 この更新には脆弱性(CVE-2026-21637, CVE-2026-21710, CVE-2026-21713, CVE-2026-21714, CVE-2026-21717, CVE-2026-21715, CVE-202... https://kusanagi.tokyo/releases/23908/

    Post summary

    The post announces a module update that addresses several CVEs, effectively providing a patch, but offers no technical detail of the vulnerabilities or exploitation information.

    01020120
    200 followersView on X
  • 草薙 沙耶(KUSANAGI)@kusanagi_saya
    Patch

    重要: kusanagi-nodejs22 脆弱性情報 概要 公開日時 2026-03-30 深刻度 重要 モジュール kusanagi-nodejs22 対象 kusanagi10 脆弱性情報 kusanagi-nodejs22の脆弱性情報を公開しました。修正した脆弱性は以下の通りとなります。 (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High... https://kusanagi.tokyo/releases/23906/

    Post summary

    The notice confirms that CVE‑2026‑21637 has been patched in kusanagi-nodejs22, highlights its high severity, and directs readers to the vendor release page for details.

    01010107
    200 followersView on X
  • Aun shah/ Ali memon@Aunshah102
    Patch

    @rafaelgss Another significant fix is for CVE-2026-21637, addressing the invocation of SNICallback within a try/catch block, improving the robustness of TLS handling. 4/17

    Post summary

    The tweet announces a patch for CVE-2026-21637, addressing a flaw in TLS handling by fixing the SNICallback invocation within a try/catch block to enhance robustness.

    1000024
    17 followersView on X
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidades en productos Node.js ❗ CVE-2026-21710 ❗ CVE-2026-21637 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-node-js/ https://t.co/7nU2cSliLt

    Post summary

    The tweet merely lists two Node.js CVEs and offers a link for additional information, with no details on exploits, patches, or technical aspects.

    00010112
    6.6K followersView on X
  • Praveen SA 🙏@praveensacharya

    Recent Key Vulnerabilities Affecting Node.js 20 Prior to and surrounding its EOL timeline, several critical security issues were identified that impact the Node.js 20.x runtime line:😁 • HTTP/2 RST_STREAM Heap Use-After-Free (CVE-2026-56848): A High severity flaw where a remote, unauthenticated attacker can trigger a process crash. The HTTP/2 server can force a stream write that re-enters session memory allocation while it is still processing received frames, resulting in an availability denial-of-service (DoS). • Permission Model Radix-Tree Over-Grant (CVE-2026-58043): A High severity issue where a flaw in prefix boundary handling allows an attacker with partial filesystem access to read or write to paths completely outside the intended restricted allowlist. • HTTP/2 Resource Exhaustion (CVE-2026-56846): A High severity memory flaw where retained header blocks escape the maxSessionMemory limit, allowing a remote client to consume all process memory and force a crash. • Bypass File System Permissions via Symlinks (CVE-2025-55130): A High severity flaw in the Permissions model where path restrictions (--allow-fs-read and --allow-fs-write) can be escaped using relative symbolic links, enabling unauthorized system file access. • TLS Callback Exceptions DoS (CVE-2026-21637): A Medium severity bug where synchronous exceptions thrown inside pskCallback or ALPNCallback bypass standard TLS error paths, causing file descriptor leaks or sudden process termination.

    0000066
    309 followersView on X
  • WindowsForum@windowsforum
    Disclosure

    🪟 CVE-2026-21637 is the “oops, your server can be DDoS’d by paperwork” kind of bug. Fixing TLS callback DoS matters because one bad handshake shouldn’t KO prod. #Windows11 https://windowsforum.com/threads/cve-2026-21637-node-js-tls-callback-dos-pskcallback-and-alpncallback-fixes.412918/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #PatchManagement #NodeJsSecurity #Cve202621637 #TlsDenialOfService

    Post summary

    The post announces the CVE‑2026‑21637 TLS callback denial‑of‑service flaw, noting its DDoS potential via handshake mishandling, but offers no PoC, exploit, or evidence of active attacks.

    0000032
    1.1K followersView on X
  • 草薙 沙耶(KUSANAGI)@kusanagi_saya
    Patch

    kusanagi-nodejs22 Module Update 22.22.2-1 KUSANAGI 9 modules have been updated. The updated modules are as follows: nodejs 22.22.2-1 This update includes support for vulnerability(CVE-2026-21637, CVE-2026-21710, CVE-2026-21713, CVE-2026-21714,... https://kusanagi.tokyo/en/releases/23909/

    Post summary

    The Kusanagi nodejs module update 22.22.2-1 includes patches for CVE-2026-21637, CVE-2026-21710, CVE-2026-21713, CVE-2026-21714, and other related vulnerabilities.

    0000065
    200 followersView on X
  • Ferramentas Linux@Cezar_H_Linux
    Patch

    BREAKING: #Debian just issued DSA-6183-1 for Node.js. 7 CVEs (CVE-2026-21637 series) enable DoS, side-channel attacks & data leaks. If you run Debian trixie with Node.js <20.19.2, you're exposed. Thread: What you need to do NOW? Read more: 👉 https://tinyurl.com/ycpfae6r #Security https://t.co/mx9NwUpbNS

    Post summary

    Debian has issued DSA‑6183‑1 for Node.js, covering seven CVEs that could allow DoS, side‑channel attacks, and data leaks on Tréxxie; users should upgrade to Node.js ≥20.19.2 to mitigate.

    00000104
    1.5K followersView on X
  • Cybersecurity News Everyday@TweetThreatNews
    Patch

    Node.js patches critical flaws in versions 20.x, 22.x, 24.x, and 25.x, fixing vulnerabilities including a remote DoS risk from an incomplete CVE-2026-21637 TLS SNICallback exception fix. #NodejsUpdate #DoSFix #USA https://ift.tt/LXoPJ5D

    Post summary

    Node.js has released patches for versions 20.x, 22.x, 24.x, and 25.x that fix critical flaws, including the remote DoS vulnerability related to CVE-2026-21637’s TLS SNICallback exception.

    00000115
    3.8K followersView on X
  • Threatwhere@threatwhere
    Patch

    🔐 UNITED STATES: Node.js has released security patch v20.20.2 'Iron' addressing 7 vulnerabilities, including remotely exploitable flaws in TLS error handling, HTTP/2 flow control, and cryptographic timing. CVE-2026-21637 poses denial-of-service and system crash risk. Immediate patching advised. #NodeJS #UnitedStates #CyberVulnerability #ThreatIntel #OSINT #Threatwhere 🌐 https://threatwhere.com

    Post summary

    Node.js has published a security patch v20.20.2 'Iron', addressing seven vulnerabilities including CVE-2026-21637, which poses a denial‑of‑service risk; immediate patching is advised.

    0000030
    97 followersView on X
  • ティー🌐@TeeTheta
    Patch

    対処された脆弱性（22.x対象8件） CVE-2026-21637 (High) CVE-2026-21710 (High) CVE-2026-21713 (Medium) CVE-2026-21714 (Medium) CVE-2026-21717 (Medium) CVE-2026-21715 (Low) CVE-2026-21716 (Low) undici 6.24.1/7.24.4 への依存更新

    Post summary

    The note declares that eight CVEs affecting version 22.x are fixed by updating the dependency to undici 6.24.1/7.24.4.

    0000071
    1 followersView on X
  • ダース葱@darthnegi
    Patch

    🚀 Node.js v24.14.1 がリリースされました。 📅 リリース日: 2026-03-24 📦 種別: patch ✨ 主な変更点: • セキュリティリリースです。 • undiciを7.24.4に更新 • npmを11.11.0にアップグレード • V8の依存関係を更新 🔧 重要な修正: • (CVE-2026-21710) headersDistinct/trailersDistinctにnullプロトタイプを使用 • (CVE-2026-21637) SNICallback呼び出しをtry/catchでラップ • (CVE-2026-21717) 配列インデックスのハッシュ衝突をテスト • (CVE-2026-21713) Web Cryptography HMACおよびKMACでタイミング安全な比較を使用 • (CVE-2026-21714) NGHTTP2_ERR_FLOW_CONTROLエラーコードを処理 • (CVE-2026-21712) 異なるURL形式でのURLクラッシュを処理 • (CVE-2026-21716) lib/fs/promisesにパーミッションチェックを含める • (CVE-2026-21715) realpath.nativeにパーミッションチェックを追加 #GitHub #Release #Node.js

    Post summary

    Node.js v24.14.1 is a security patch release fixing several CVEs, including CVE‑2026‑21710 and CVE‑2026‑21637, with specific updates to handle null prototypes, SNICallback, and other vulnerabilities.

    0000066
    2 followersView on X
  • ダース葱@darthnegi
    Patch

    🚀 Node.js v25.8.2 がリリースされました。 📅 リリース日: 2026-03-24 📦 種別: patch ✨ 主な変更点: • セキュリティリリース。 🔧 重要な修正: • SNICallbackの呼び出しをtry/catchでラップ (CVE-2026-21637) - 高 • headersDistinct/trailersDistinctにnullプロトタイプを使用 (CVE-2026-21710) - 高 • pipe_wrap.ccにパーミッションチェックを追加 (CVE-2026-21711) - 中 • 異なるURL形式でのURLクラッシュを処理 (CVE-2026-21712) - 中 • Web Cryptography HMACおよびKMACでタイミングセーフな比較を使用 (CVE-2026-21713) - 中 • NGHTTP2_ERR_FLOW_CONTROLエラーコードを処理 (CVE-2026-21714) - 中 • 配列インデックスハッシュ衝突のテスト (CVE-2026-21717) - 中 • realpath.nativeにパーミッションチェックを追加 (CVE-2026-21715) - 低 • lib/fs/promisesにパーミッションチェックを追加 (CVE-2026-21716) - 低 #GitHub #Release #Node.js

    Post summary

    Node.js v25.8.2 has been released as a security patch addressing several CVEs, providing specific technical fixes.

    0000049
    2 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnodejsnode.js---

Explore more

Back to dashboardnodejs CVEsnode.js vulnerabilities