CVE-2026-126051: Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not establishedNothing in the sources we check

DescriptionNVD

A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x.

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

NULL Pointer Dereference · Memory Corruption

Vendor

nodejs

Published

November 2026

Band

Unlikely (under 1%), November 2026

• Red Hat Enterprise Linux 10Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Red Hat Enterprise Linux 9Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Red Hat Enterprise Linux 8Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Ubuntu 26.04Under investigationchecked 15 Nov 09:30 UTC
• Ubuntu 24.04Under investigationchecked 15 Nov 09:30 UTC
• Ubuntu 22.04Under investigationchecked 15 Nov 09:30 UTC
• Debian 13Affected, no fix releasedchecked 15 Nov 09:30 UTC
• Debian 12Affected, no fix releasedchecked 15 Nov 09:30 UTC
• SUSE Linux Enterprise Server 16.1Affected, no fix releasedchecked 15 Nov 09:30 UTC
• SUSE Linux Enterprise Server 16.0Affected, no fix releasedchecked 15 Nov 09:30 UTC
• SUSE Linux Enterprise Server 15 SP7Affected, no fix releasedchecked 15 Nov 09:30 UTC
• openSUSE Leap 16.1Affected, no fix releasedchecked 15 Nov 09:30 UTC
• openSUSE Leap 16.0Affected, no fix releasedchecked 15 Nov 09:30 UTC

1. 15 Nov
   SUSE’s tracker lists openSUSE Leap 16.0 as affected, with no fix released SUSE
2. 15 Nov
   SUSE’s tracker lists openSUSE Leap 16.1 as affected, with no fix released SUSE
3. 15 Nov
   SUSE’s tracker lists SLES 15 SP6 as affected, with no fix released SUSE
4. 15 Nov
   SUSE’s tracker lists SLES 15 SP7 as affected, with no fix released SUSE
5. 15 Nov
   SUSE’s tracker lists SLES 16.0 as affected, with no fix released SUSE
6. 15 Nov
   SUSE’s tracker lists SLES 16.1 as affected, with no fix released SUSE
7. 14 Nov
   Debian’s tracker lists Debian 12 as affected, with no fix released Debian
8. 14 Nov
   Debian’s tracker lists Debian 13 as affected, with no fix released Debian
9. 14 Nov
   Red Hat’s tracker lists RHEL 10 as affected, with no fix released Red Hat
10. 14 Nov
    Red Hat’s tracker lists RHEL 8 as affected, with no fix released Red Hat
11. 14 Nov
    Red Hat’s tracker lists RHEL 9 as affected, with no fix released Red Hat
12. 14 Nov
    Ubuntu’s tracker lists Ubuntu 14.04 as under investigation Ubuntu
13. 14 Nov
    Ubuntu’s tracker lists Ubuntu 16.04 as under investigation Ubuntu
14. 14 Nov
    Ubuntu’s tracker lists Ubuntu 18.04 as under investigation Ubuntu
15. 14 Nov
    Ubuntu’s tracker lists Ubuntu 20.04 as under investigation Ubuntu
16. 14 Nov
    Ubuntu’s tracker lists Ubuntu 22.04 as under investigation Ubuntu
17. 14 Nov
    Ubuntu’s tracker lists Ubuntu 24.04 as under investigation Ubuntu
18. 14 Nov
    Ubuntu’s tracker lists Ubuntu 26.04 as under investigation Ubuntu
19. 14 Nov
    Ubuntu’s tracker lists Ubuntu stonking as under investigation Ubuntu

• NVD entrynvd.nist.gov
• Vendor advisorynodejs.org
• CVE recordcve.org