DEBIAN-CVE-2026-126051: High severity debian/nodejs vulnerability
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x.
Affected Software
Event History
Frequently Asked Questions
Which Node.js TLS servers are exposed?
Node.js 26.x and 24.x TLS servers are affected when they use SNICallback, OCSPRequest, newSession, or resumeSession hooks, or call server.addContext(). The issue is in deferred OpenSSL callback handling during the TLS handshake.
Does exploitation require authentication or interaction from a legitimate user?
No. A remote attacker can trigger the condition without authentication or user interaction by sending a crafted TLS ClientHello and then closing the socket in a way that causes the ClientHello and end-of-file to be processed in the same tick.
What is the practical impact of successful exploitation?
Successful exploitation terminates the Node.js server process through an uncaught exception rather than an emitted error event. The provided information indicates a denial-of-service impact, with no confidentiality or integrity impact.
How can I determine whether an application is potentially affected?
Check whether the application runs Node.js 24.x or 26.x and operates a TLS server using any of the listed handshake hooks or server.addContext(). A process crash during TLS handshake processing with an uncaught exception is consistent with the described condition.