---
id: "CVE-2026-126051"
page: "https://infrastack.ai/live/CVE-2026-126051"
kind: "vulnerability"
aliases: ["CVE-2026-126051"]
title: "Node.js: crafted TLS handshake crashes the server process remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Node.js", "fixed": [], "affected": "", "ecosystem": "runtime"}]
ecosystems: ["runtime"]
tags: ["node.js", "runtime", "self-hosted", "tls"]
not_affected_if: ["no-tls-server-hooks", "other-node-versions"]
published_at: "2026-11-11T19:17:36+00:00"
first_seen_at: "2026-11-11T19:28:46+00:00"
updated_at: "2026-11-11T19:30:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126051", "first_seen_at": "2026-11-11T19:28:46+00:00"}]
exploit_sources: []
---

# Node.js: crafted TLS handshake crashes the server process remotely

Link for people: https://infrastack.ai/live/CVE-2026-126051 (this .md is for agents)

A deferred TLS callback in Node.js can use a socket after it has been destroyed, which happens when a client hello and a FIN arrive together. The result is an uncaught exception that terminates the server process instead of emitting an 'error' event.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- runtime:Node.js affected range not listed fixed no fixed version listed

## How to check

- Run `node --version` and see whether it reports a 26.x or 24.x release.
- Search your code for TLS servers that set `SNICallback`, `OCSPRequest`, `newSession`, or `resumeSession`, or that call `server.addContext()`.

## Timeline

- 2026-11-11T19:28:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126051

## From the sources

A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_