ALPINE-CVE-2026-126051: High severity alpine/nodejs vulnerability
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0
Event History
Frequently Asked Questions
Which deployments are exposed to remote denial of service?
Node.js TLS servers on the affected 26.x or 24.x lines are exposed when they use SNICallback, OCSPRequest, newSession, or resumeSession hooks, or call server.addContext(). A remote unauthenticated client can trigger process termination.
Does exploitation require credentials or user interaction?
No. The issue is remotely exploitable with no privileges or user interaction required; the attacker needs to connect to the TLS server and send a crafted ClientHello followed by padding and a socket FIN.
What configuration condition enables the vulnerable path?
The vulnerable path is used when the TLS server has one of the listed TLS callbacks configured or uses server.addContext(). The provided data does not establish that a TLS server without those hooks or additional contexts is affected.
How would an active attack appear operationally?
The Node.js server process terminates with an uncaught exception rather than emitting an error event. This can cause a denial of service until the process is restarted.