CVE-2026-21637: Node.js TLS server crash when PSK, ALPN or SNI callbacks throw

High 7.5 EPSS 1.1% Node.js

Exceptions thrown synchronously inside TLS handshake callbacks bypass Node.js TLS error handling, so a remote client can crash a TLS server or leak file descriptors until it fails. The January 2026 fix covered pskCallback and ALPNCallback; the March 24, 2026 releases fixed the remaining SNICallback path under the same CVE ID and Node.js rated that High. Only TLS servers whose callbacks can throw on unexpected client input are affected; no known exploitation.

• CVE-2026-21637CVE identifier
• 7.5CVSS 3.1 base score (high)
• 1.1%EPSS: chance of exploitation in the next 30 days (higher than 66% of CVEs)
• 2026-01-20published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• pskCallback / ALPNCallback: Node.js 20.x up to 20.19.6, 22.x up to 22.21.1, 24.x up to 24.12.0, 25.x up to 25.2.1
• SNICallback (incomplete fix): Node.js 20.x before 20.20.2, 22.x before 22.22.2, 24.x before 24.14.1, 25.x before 25.8.2

Fixed in:

• Node.js 20.20.2
• Node.js 22.22.2
• Node.js 24.14.1
• Node.js 25.8.2

Node.js lines affected: 20.x || 22.x || 24.x || 25.x; fixed in ^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2.

Am I affected?

node -v
dpkg -l nodejs 'libnode*' 2>/dev/null | grep ^ii      # Debian/Ubuntu
rpm -q nodejs nodejs22 nodejs24 2>/dev/null; dnf module list --enabled nodejs   # RHEL
apk info -v nodejs nodejs-current 2>/dev/null          # Alpine
docker run --rm <image> node -v                         # containers
grep -rnE "SNICallback|pskCallback|ALPNCallback" --include='*.js' --include='*.mjs' --include='*.ts' .   # TLS servers using these callbacks

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt install --only-upgrade nodejs
node -v
# Debian ships nodejs 18.x (bookworm) and 20.x (trixie) with backported fixes.
# Running 22/24/26 from NodeSource (deb.nodesource.com)? The same command installs the fixed upstream build.

# Ubuntu has not published a nodejs fix for this CVE (tracker status needs-triage, 2026-11-03).
# See https://ubuntu.com/security/CVE-2026-21637. Use a fixed upstream build instead:
# If Node.js comes from the NodeSource repo (deb.nodesource.com), the fixed builds are there:
sudo apt update
sudo apt install --only-upgrade nodejs
node -v

sudo dnf module list --enabled nodejs        # RHEL 8/9: which stream is enabled
sudo dnf upgrade --refresh 'nodejs*'
node -v
# Stream with no fix (or EOL nodejs:20)? switch to a fixed stream, e.g. nodejs:24 on RHEL 8/9:
sudo dnf module reset -y nodejs && sudo dnf module enable -y nodejs:24 && sudo dnf distro-sync -y 'nodejs*'
# RHEL 10 ships nodejs22 / nodejs24 as normal packages: sudo dnf install nodejs24

sudo dnf upgrade --refresh nodejs22 nodejs24 (nodejsNN)

sudo zypper refresh
sudo zypper update nodejs22 nodejs24

sudo dnf upgrade --releasever=latest nodejs22 nodejs24 (nodejsNN)

sudo pacman -Syu

apk update
apk upgrade nodejs          # main repo (22.x on 3.22, 24.x on 3.23/3.24)
apk upgrade nodejs-current  # community repo, if installed (26.x on 3.24)
node -v

pkg update && pkg upgrade node (or node22/node24)

# Move the FROM line to a fixed tag (or a moving major tag such as node:24-slim) and rebuild
#   FROM node:24.22.2-trixie-slim   (also: node:22.23.4-alpine, node:26.13.0-slim)
docker pull node:24.22.2-trixie-slim
docker build --pull -t myapp:patched .
docker run --rm myapp:patched node -v   # must be at least 22.22.2 / 24.14.1
docker compose up -d --force-recreate   # or redeploy / roll out the new image

# nvm: install the newest patch release of your line and make it the default
nvm install 24 --reinstall-packages-from=current   # or 22 / 26
nvm alias default 24
node -v   # must be at least 22.22.2 / 24.14.1 (any current 22.x/24.x/26.x release)
# Official binaries (Linux x64); verify the checksum before installing
VER=v24.22.2   # current fixed releases: v22.23.4, v24.22.2, v26.13.0
curl -fsSLO https://nodejs.org/dist/$VER/node-$VER-linux-x64.tar.xz
curl -fsSLO https://nodejs.org/dist/$VER/SHASUMS256.txt
grep " node-$VER-linux-x64.tar.xz\$" SHASUMS256.txt | sha256sum -c -
sudo tar -xJf node-$VER-linux-x64.tar.xz -C /usr/local --strip-components=1
/usr/local/bin/node -v

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Make SNICallback, pskCallback and ALPNCallback unable to throw: wrap their bodies in try/catch and report errors through the callback instead (the advisory limits impact to callbacks that throw without being safely wrapped).
• Severity differs by source: the CVE record still carries the January text (CVSS 5.9 Medium, Red Hat Moderate); the Node.js March 2026 advisory and the security WG index rate the SNICallback follow-up High.
• Node.js 20.x reached end-of-life on 2026-04-30 and 25.x on 2026-06-01; supported lines on 2026-11-03 are 22.x and 24.x (Maintenance LTS) and 26.x (Active LTS). End-of-life lines get no further fixes.

Related vulnerabilities

• CVE-2026-21710

Sources

• Node.js security releases, March 24, 2026
• Node.js security releases, January 13, 2026
• CVE record CVE-2026-21637
• NVD: CVE-2026-21637
• GitHub advisory GHSA-ggxc-26fx-987r (CVE-2026-21637)
• Debian security tracker: CVE-2026-21637
• Ubuntu CVE tracker: CVE-2026-21637
• Red Hat CVE page: CVE-2026-21637
• Alpine secdb (v3.22/v3.23/v3.24 main + community)
• Node.js security WG vulnerability index
• Node.js release status (previous releases)
• https://nodejs.org/en/blog/vulnerability/december-2025-security-releases

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.