{"id":"CVE-2026-126051","kind":"vulnerability","aliases":["CVE-2026-126051"],"related":[],"title":"Node.js: crafted TLS handshake crashes the server process remotely","description":"A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x.","summary":"A deferred TLS callback in Node.js can use a socket after it has been destroyed, which happens when a client hello and a FIN arrive together. The result is an uncaught exception that terminates the server process instead of emitting an 'error' event.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Node.js","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["node.js","runtime","self-hosted","tls"],"not_affected_if":["no-tls-server-hooks","other-node-versions"],"how_to_check":"- Run `node --version` and see whether it reports a 26.x or 24.x release.\n- Search your code for TLS servers that set `SNICallback`, `OCSPRequest`, `newSession`, or `resumeSession`, or that call `server.addContext()`.","fix":null,"status":"open","published_at":"2026-11-11T19:17:36+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","triaged_at":"2026-11-11T19:30:10+00:00","updated_at":"2026-11-11T19:30:10+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-11T19:30:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Node.js: crafted TLS handshake crashes the server process remotely","impact":"medium","summary":"A deferred TLS callback in Node.js can use a socket after it has been destroyed, which happens when a client hello and a FIN arrive together. The result is an uncaught exception that terminates the server process instead of emitting an 'error' event.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["node.js","tls","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote unauthenticated attacker crashes the Node.js server process.","analyst_note":"","how_to_check":"- Run `node --version` and see whether it reports a 26.x or 24.x release.\n- Search your code for TLS servers that set `SNICallback`, `OCSPRequest`, `newSession`, or `resumeSession`, or that call `server.addContext()`.\n- unknown","plain_action":"","product_name":"Node.js","needs_analyst":false,"not_affected_if":["other-node-versions","no-tls-server-hooks"],"who_is_affected":"Exposure requires a Node.js 26.x or 24.x TLS server that uses the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(). An attacker needs only network access to the TLS port and can send a crafted client hello followed by a FIN, so internet-facing TLS services are the main concern. Servers on other Node.js lines, or TLS servers that use none of these hooks, are not described as affected.","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001231,"input_tokens":4749,"output_tokens":1513,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126051':12A,15A '-2026':11A,14A '24':202C '26':199C 'affect':197C 'allow':80C 'arriv':47B 'attack':84C,155C 'callback':26B,69C,109C,180C 'client':42B,131C,160C 'code':115C 'correspond':107C 'craft':2A 'crash':5A 'cve':10A,13A 'defer':24B,68C,111C,114C,179C 'deferred-callback':67C 'deliv':158C 'destroy':37B,73C,123C,176C 'emit':62B,191C 'end':165C 'end-of-fil':164C 'error':64B,193C 'event':65B,194C 'exampl':139C 'except':54B,188C 'execut':127C 'file':167C 'fin':46B,153C 'follow':147C 'handl':79C,118C 'handshak':4A,78C 'happen':39B 'hello':43B,132C,161C 'hook':103C 'host':21B 'instead':60B,189C 'make':156C 'newsess':100C 'node.js':1A,16A,17B,28B,75C,198C 'ocsp':145C 'ocsprequest':99C 'openssl':108C,157C 'pad':149C 'path':137C 'process':8A,59B,89C,184C 'rais':185C 'reach':134C 'remot':9A,82C 'request':146C 'result':50B 'resumesess':102C 'run':181C 'runtim':18B 'schedul':125C 'self':20B 'self-host':19B 'send':129C 'server':7A,58B,77C,88C,93C 'server.addcontext':105C 'sni':141C 'snicallback':98C 'socket':32B,121C,152C,174C 'termin':56B,86C 'tick':171C 'tls':3A,22B,25B,76C,92C 'togeth':48B,142C 'unauthent':83C 'uncaught':53B,187C 'under':120C 'use':30B,71C,94C 'use-after-destroy':70C 'vulner':136C,196C 'x':200C,203C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires a Node.js 26.x or 24.x TLS server that uses the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(). An attacker needs only network access to the TLS port and can send a crafted client hello followed by a FIN, so internet-facing TLS services are the main concern. Servers on other Node.js lines, or TLS servers that use none of these hooks, are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["nodejs"],"ptokens":["nodejs"],"labels":["high","nodejs","runtime","selfhosted","tls"],"campaign_type":null,"search_a":"'-126051':12A,15A '-2026':11A,14A 'craft':2A 'crash':5A 'cve':10A,13A 'handshak':4A 'node.js':1A,16A 'process':8A 'remot':9A 'server':7A 'tls':3A","search_b":"'arriv':47B 'callback':26B 'client':42B 'defer':24B 'destroy':37B 'emit':62B 'error':64B 'event':65B 'except':54B 'fin':46B 'happen':39B 'hello':43B 'host':21B 'instead':60B 'node.js':17B,28B 'process':59B 'result':50B 'runtim':18B 'self':20B 'self-host':19B 'server':58B 'socket':32B 'termin':56B 'tls':22B,25B 'togeth':48B 'uncaught':53B 'use':30B","search_c":"'24':202C '26':199C 'affect':197C 'allow':80C 'attack':84C,155C 'callback':69C,109C,180C 'client':131C,160C 'code':115C 'correspond':107C 'defer':68C,111C,114C,179C 'deferred-callback':67C 'deliv':158C 'destroy':73C,123C,176C 'emit':191C 'end':165C 'end-of-fil':164C 'error':193C 'event':194C 'exampl':139C 'except':188C 'execut':127C 'file':167C 'fin':153C 'follow':147C 'handl':79C,118C 'handshak':78C 'hello':132C,161C 'hook':103C 'instead':189C 'make':156C 'newsess':100C 'node.js':75C,198C 'ocsp':145C 'ocsprequest':99C 'openssl':108C,157C 'pad':149C 'path':137C 'process':89C,184C 'rais':185C 'reach':134C 'remot':82C 'request':146C 'resumesess':102C 'run':181C 'schedul':125C 'send':129C 'server':77C,88C,93C 'server.addcontext':105C 'sni':141C 'snicallback':98C 'socket':121C,152C,174C 'termin':86C 'tick':171C 'tls':76C,92C 'togeth':142C 'unauthent':83C 'uncaught':187C 'under':120C 'use':71C,94C 'use-after-destroy':70C 'vulner':136C,196C 'x':200C,203C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126051","severity":null,"published_at":"2026-11-11T19:17:36+00:00","modified_at":"2026-11-11T19:17:36+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","fetched_at":"2026-11-11T19:28:46+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}