ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-126051

A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process.

Published Nov 11, 2026 · catalog updated Nov 12, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 12, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-126051. A missing EPSS score is not a low risk. Compare Red Hat Red Hat Enterprise Linux with the linked advisory before you change production.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.

Same product and reporting

Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Not in the current FIRST EPSS dataset
Remediation
Advisory link
Affected products
Alpine:v3.23 nodejs · Alpine:v3.24 nodejs

A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Alpine:v3.23 nodejs0 → 24.22.3-r0
  • Alpine:v3.24 nodejs0 → 24.22.3-r0

How to fix CVE-2026-126051

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for CVE-2026-126051. A missing EPSS score is not a low risk. Compare Red Hat Red Hat Enterprise Linux with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0 → 24.22.3-r0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-248. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 11, 2026 · Red Hat Security Data

    Detected

    nodejs: nodejs: Denial of service via premature socket closure during TLS handshake

  2. Nov 12, 2026 · Trivy Vulnerability DB

    Fix available

    nodejs fixed in 24.22.3-r0; nodejs fixed in 24.22.3-r0

  3. Nov 12, 2026 · Trivy Vulnerability DB

    Fix available

    nodejs fixed in 24.22.3-r0

  4. Nov 12, 2026 · Trivy Vulnerability DB

    Updated

    A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed

Sources

  • Red Hat Security DataVendor advisoryCVE-2026-126051

    nodejs: nodejs: Denial of service via premature socket closure during TLS handshake

    access.redhat.com
  • Trivy Vulnerability DBPackage advisoryALPINE-CVE-2026-126051

    A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the co

    osv.dev

References

Freshness

Last verified in this catalog Nov 12, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Trivy Vulnerability DBNov 12, 2026
  • Red Hat Security DataNov 12, 2026