UBUNTU-CVE-2026-126051: Medium severity ubuntu/nodejs vulnerability
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x.
Affected Software
Event History
Frequently Asked Questions
Which TLS servers are exposed to this issue?
Node.js TLS servers in the affected 26.x and 24.x release lines are exposed when they use SNICallback, OCSPRequest, newSession, resumeSession, or server.addContext(). The issue is reachable remotely by an unauthenticated client.
Does a default TLS server configuration appear to be affected?
The vulnerable path requires use of one of the listed TLS handshake hooks or server.addContext(). The provided information does not indicate that a TLS server without those features enabled is affected.
What would an attacker need to do to trigger the failure?
An attacker needs to connect to the TLS server and send a ClientHello that reaches a vulnerable callback path, then cause the connection to end so that OpenSSL processes the ClientHello and EOF in the same event-loop tick. One described example is a ClientHello without SNI that includes an OCSP request, followed by padding and a socket FIN.
What is the practical impact of successful exploitation?
The deferred callback can run after its underlying socket has been destroyed, causing an uncaught exception rather than an error event. This terminates the Node.js server process.