CVE-2026-126051

Name of the Vulnerable Software and Affected Versions Node.js versions 24.x Node.js versions 26.x

Description A use-after-destroy issue in the TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. This occurs when a TLS server utilizes server.addContext() or hooks such as SNICallback, OCSPRequest, newSession, or resumeSession. In these cases, OpenSSL callbacks are deferred, but the system fails to handle scenarios where the underlying socket is destroyed between the scheduling and execution of the deferred code. An attacker can trigger this by sending a client hello that reaches the vulnerable path, followed by padding and a socket FIN, causing the process to raise an uncaught exception instead of emitting an 'error' event.

Recommendations Update Node.js version 24.x to a patched release. Update Node.js version 26.x to a patched release.