CVE-2026-21637

HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers

CVE-2026-21637 is fixed in 44 products on 2 platforms, first by Node.js 25.3.0, released January 12, 2026. 12 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms
CVSS
7.5
Moderate
Exploitation
None reported
N/A
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0112
66th percentile

<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-21637">CVE-2026-21637</a> is regarding a vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. HackerOne created this CVE on their behalf. The documented Visual Studio updates incorporate updates in Node.js which address this vulnerability.</p> <p>Please see <a href="https://www.cve.org/CVERecord?id=CVE-2026-21637">CVE-2026-21637</a> for more information.</p>

Where it's fixed

ProductFixed inFixReleased
Windows apps
Node.js 25.3.0 Node.js 25.3.0 Jan 12, 2026
Node.js (LTS) 24.13.0 Node.js (LTS) 24.13.0 Jan 12, 2026
Node.js 20 20.20.0 Node.js 20 20.20.0 Jan 12, 2026
Node.js 22 22.22.0 Node.js 22 22.22.0 Jan 12, 2026
Linux
nodejs · Debian 12.15 (bookworm) 18.20.4+dfsg-1~deb12u2 DEBIAN-CVE-2026-21637 Jan 20, 2026
nodejs · Debian 13.5 (trixie) 20.19.2+dfsg-1+deb13u2 DSA-6183-1 Mar 29, 2026
nodejs · Debian 14 22.22.2+dfsg+~cs22.19.15-1 DEBIAN-CVE-2026-21637 Jan 20, 2026
nodejs · RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs · RHEL 9 1:24.14.1-2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs · almalinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
nodejs · almalinux 9 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
nodejs · ol 10 1:22.22.0-3.el10_1 ELSA-2026-1843 Feb 4, 2026
nodejs · ol 8 1:24.13.0-0.module+el8.10.0+90779+0cc618fe ELSA-2026-2420 Feb 10, 2026
nodejs · ol 9 1:24.13.0-1.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781 Feb 17, 2026
nodejs · rocky 8 1:20.20.0-1.module+el8.10.0+40077+29236b21 RLSA-2026:2422 Feb 11, 2026
nodejs-devel · RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-devel · RHEL 9 1:24.14.1-2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-devel · almalinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
nodejs-devel · almalinux 9 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
nodejs-devel · ol 10 1:22.22.0-3.el10_1 ELSA-2026-1843 Feb 4, 2026
nodejs-devel · ol 8 1:24.13.0-0.module+el8.10.0+90779+0cc618fe ELSA-2026-2420 Feb 10, 2026
nodejs-devel · ol 9 1:24.13.0-1.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781 Feb 17, 2026
nodejs-docs · RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-docs · RHEL 9 1:24.14.1-2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-docs · almalinux 10 1:22.22.0-3.el10_1 ALSA-2026:1843 Feb 3, 2026
nodejs-docs · almalinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
nodejs-docs · almalinux 9 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
nodejs-docs · ol 10 1:22.22.0-3.el10_1 ELSA-2026-1843 Feb 4, 2026
nodejs-docs · ol 8 1:24.13.0-0.module+el8.10.0+90779+0cc618fe ELSA-2026-2420 Feb 10, 2026
nodejs-docs · ol 9 1:24.13.0-1.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781 Feb 17, 2026
nodejs-full-i18n · RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-full-i18n · RHEL 9 1:24.14.1-2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-full-i18n · almalinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
nodejs-full-i18n · almalinux 9 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
nodejs-full-i18n · ol 10 1:22.22.0-3.el10_1 ELSA-2026-1843 Feb 4, 2026
nodejs-full-i18n · ol 8 1:24.13.0-0.module+el8.10.0+90779+0cc618fe ELSA-2026-2420 Feb 10, 2026
nodejs-full-i18n · ol 9 1:24.13.0-1.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781 Feb 17, 2026
nodejs-libs · RHEL 8 1:24.14.1-2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-libs · RHEL 9 1:24.14.1-2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-libs · almalinux 8 1:24.14.1-2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
nodejs-libs · almalinux 9 1:24.14.1-2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
nodejs-libs · ol 10 1:22.22.0-3.el10_1 ELSA-2026-1843 Feb 4, 2026
nodejs-libs · ol 8 1:24.13.0-0.module+el8.10.0+90779+0cc618fe ELSA-2026-2420 Feb 10, 2026
nodejs-libs · ol 9 1:24.13.0-1.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781 Feb 17, 2026
nodejs-nodemon · RHEL 8 0:3.0.3-1.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-nodemon · RHEL 9 0:3.0.3-3.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-nodemon · almalinux 8 3.0.3-1.module_el8.10.0+4061+f8ceeab9 ALSA-2026:7670 Apr 13, 2026
nodejs-nodemon · almalinux 9 3.0.3-3.module_el9.7.0+209+ecf6523e ALSA-2026:7350 Apr 9, 2026
nodejs-nodemon · ol 8 0:3.0.3-1.module+el8.10.0+90779+0cc618fe ELSA-2026-2420 Feb 10, 2026
nodejs-nodemon · ol 9 0:3.0.3-3.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781 Feb 17, 2026
nodejs-nodemon · rocky 8 0:3.0.3-1.module+el8.10.0+2084+ab509703 RLSA-2026:7670 Apr 13, 2026
nodejs-nodemon · rocky 9 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2 RLSA-2026:7350 Apr 10, 2026
nodejs-npm · ol 10 1:10.9.4-1.22.22.0.3.el10_1 ELSA-2026-1843 Feb 4, 2026
nodejs-packaging · RHEL 8 0:2021.06-6.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-packaging · RHEL 9 0:2021.06-6.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-packaging · almalinux 8 2021.06-6.module_el8.10.0+4086+70facd4a ALSA-2026:7670 Apr 13, 2026
nodejs-packaging · almalinux 9 2021.06-6.module_el9.7.0+209+ecf6523e ALSA-2026:7350 Apr 9, 2026
nodejs-packaging · ol 8 0:2021.06-6.module+el8.10.0+90779+0cc618fe ELSA-2026-2420 Feb 10, 2026
nodejs-packaging · ol 9 0:2021.06-6.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781 Feb 17, 2026
nodejs-packaging · rocky 8 0:2021.06-6.module+el8.10.0+40048+6d99f608 RLSA-2026:7670 Apr 13, 2026
nodejs-packaging · rocky 9 0:2021.06-6.module+el9.7.0+40052+e32ea525 RLSA-2026:7350 Apr 10, 2026
nodejs-packaging-bundler · RHEL 8 0:2021.06-6.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
nodejs-packaging-bundler · RHEL 9 0:2021.06-6.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
nodejs-packaging-bundler · almalinux 8 2021.06-6.module_el8.10.0+4086+70facd4a ALSA-2026:7670 Apr 13, 2026
nodejs-packaging-bundler · almalinux 9 2021.06-6.module_el9.7.0+198+8bf605ba ALSA-2026:7350 Apr 9, 2026
nodejs-packaging-bundler · ol 8 0:2021.06-6.module+el8.10.0+90779+0cc618fe ELSA-2026-2420 Feb 10, 2026
nodejs-packaging-bundler · ol 9 0:2021.06-6.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781 Feb 17, 2026
nodejs20 · amzn 2023 1:20.20.0-1.amzn2023.0.1 ALAS2023-2026-1402 Feb 5, 2026
nodejs20 · opensuse-leap 15.6 20.20.0-150600.3.15.1 SUSE-SU-2026:0435-1 Feb 11, 2026
nodejs20 · sles 15.6 20.20.2-150600.3.18.1 SUSE-SU-2026:1363-1 Apr 15, 2026
nodejs20 · sles 15.6 20.20.0-150600.3.15.1 SUSE-SU-2026:0435-1 Feb 11, 2026
nodejs20-debuginfo · amzn 2023 1:20.20.0-1.amzn2023.0.1 ALAS2023-2026-1402 Feb 5, 2026
nodejs20-debugsource · amzn 2023 1:20.20.0-1.amzn2023.0.1 ALAS2023-2026-1402 Feb 5, 2026
nodejs20-devel · amzn 2023 1:20.20.0-1.amzn2023.0.1 ALAS2023-2026-1402 Feb 5, 2026
nodejs20-docs · amzn 2023 1:20.20.0-1.amzn2023.0.1 ALAS2023-2026-1402 Feb 5, 2026
nodejs20-full-i18n · amzn 2023 1:20.20.0-1.amzn2023.0.1 ALAS2023-2026-1402 Feb 5, 2026
nodejs20-libs · amzn 2023 1:20.20.0-1.amzn2023.0.1 ALAS2023-2026-1402 Feb 5, 2026
nodejs20-libs-debuginfo · amzn 2023 1:20.20.0-1.amzn2023.0.1 ALAS2023-2026-1402 Feb 5, 2026
nodejs20-npm · amzn 2023 1:10.8.2-1.20.20.0.1.amzn2023.0.1 ALAS2023-2026-1402 Feb 5, 2026
nodejs22 · RHEL 10 22.22.0-1.el10_0 RHSA-2026:2899 Jan 20, 2026
nodejs22 · amzn 2023 1:22.22.0-1.amzn2023.0.1 ALAS2023-2026-1403 Feb 5, 2026
nodejs22 · opensuse-leap 15.6 22.22.0-150600.13.12.1 SUSE-SU-2026:0295-1 Jan 26, 2026
nodejs22 · opensuse-leap 16.0 22.23.0-160000.1.1 OPENSUSE-SU-2026:21058-1 Jun 25, 2026
nodejs22 · rocky 10 1:22.22.0-3.el10_1 RLSA-2026:1843 Feb 6, 2026
nodejs22 · sles 15.6 22.22.2-150600.13.15.1 SUSE-SU-2026:1509-1 Apr 21, 2026
nodejs22 · sles 15.6 22.22.0-150600.13.12.1 SUSE-SU-2026:0295-1 Jan 26, 2026
nodejs22 · sles 15.7 22.22.2-150700.3.9.1 SUSE-SU-2026:1478-1 Apr 20, 2026
nodejs22 · sles 16.0 22.23.0-160000.1.1 SUSE-SU-2026:22368-1 Jun 25, 2026
nodejs22-debuginfo · amzn 2023 1:22.22.0-1.amzn2023.0.1 ALAS2023-2026-1403 Feb 5, 2026
nodejs22-debugsource · amzn 2023 1:22.22.0-1.amzn2023.0.1 ALAS2023-2026-1403 Feb 5, 2026
nodejs22-devel · amzn 2023 1:22.22.0-1.amzn2023.0.1 ALAS2023-2026-1403 Feb 5, 2026
nodejs22-docs · amzn 2023 1:22.22.0-1.amzn2023.0.1 ALAS2023-2026-1403 Feb 5, 2026
nodejs22-full-i18n · amzn 2023 1:22.22.0-1.amzn2023.0.1 ALAS2023-2026-1403 Feb 5, 2026
nodejs22-libs · amzn 2023 1:22.22.0-1.amzn2023.0.1 ALAS2023-2026-1403 Feb 5, 2026
nodejs22-libs-debuginfo · amzn 2023 1:22.22.0-1.amzn2023.0.1 ALAS2023-2026-1403 Feb 5, 2026
nodejs22-npm · amzn 2023 1:10.9.4-1.22.22.0.1.amzn2023.0.1 ALAS2023-2026-1403 Feb 5, 2026
nodejs24 · RHEL 10 24.14.1-2.el10_1 RHSA-2026:7675 Mar 12, 2026
nodejs24 · amzn 2023 1:24.13.0-1.amzn2023.0.1 ALAS2023-2026-1404 Feb 5, 2026
nodejs24 · ol 10 1:24.13.0-1.0.1.el10_1 ELSA-2026-1842 Feb 4, 2026
nodejs24 · opensuse-leap 16.0 24.14.1-160000.1.1 OPENSUSE-SU-2026:20519-1 Apr 13, 2026
nodejs24 · rocky 10 1:24.14.1-2.el10_1 RLSA-2026:7675 Apr 15, 2026
nodejs24 · sles 15.7 24.14.1-150700.15.8.1 SUSE-SU-2026:1299-1 Apr 13, 2026
nodejs24 · sles 16.0 24.14.1-160000.1.1 SUSE-SU-2026:21181-1 Apr 13, 2026
nodejs24-debuginfo · amzn 2023 1:24.13.0-1.amzn2023.0.1 ALAS2023-2026-1404 Feb 5, 2026
nodejs24-debugsource · amzn 2023 1:24.13.0-1.amzn2023.0.1 ALAS2023-2026-1404 Feb 5, 2026
nodejs24-devel · amzn 2023 1:24.13.0-1.amzn2023.0.1 ALAS2023-2026-1404 Feb 5, 2026
nodejs24-devel · ol 10 1:24.13.0-1.0.1.el10_1 ELSA-2026-1842 Feb 4, 2026
nodejs24-docs · almalinux 10 1:24.14.1-2.el10_1 ALSA-2026:7675 Apr 13, 2026
nodejs24-docs · amzn 2023 1:24.13.0-1.amzn2023.0.1 ALAS2023-2026-1404 Feb 5, 2026
nodejs24-docs · ol 10 1:24.13.0-1.0.1.el10_1 ELSA-2026-1842 Feb 4, 2026
nodejs24-full-i18n · amzn 2023 1:24.13.0-1.amzn2023.0.1 ALAS2023-2026-1404 Feb 5, 2026
nodejs24-full-i18n · ol 10 1:24.13.0-1.0.1.el10_1 ELSA-2026-1842 Feb 4, 2026
nodejs24-libs · amzn 2023 1:24.13.0-1.amzn2023.0.1 ALAS2023-2026-1404 Feb 5, 2026
nodejs24-libs · ol 10 1:24.13.0-1.0.1.el10_1 ELSA-2026-1842 Feb 4, 2026
nodejs24-libs-debuginfo · amzn 2023 1:24.13.0-1.amzn2023.0.1 ALAS2023-2026-1404 Feb 5, 2026
nodejs24-npm · almalinux 10 1:11.11.0-1.24.14.1.2.el10_1 ALSA-2026:7675 Apr 13, 2026
nodejs24-npm · amzn 2023 1:11.6.2-1.24.13.0.1.amzn2023.0.1 ALAS2023-2026-1404 Feb 5, 2026
nodejs24-npm · ol 10 1:11.6.2-1.24.13.0.1.0.1.el10_1 ELSA-2026-1842 Feb 4, 2026
npm · RHEL 8 1:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
npm · RHEL 9 1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
npm · almalinux 8 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
npm · almalinux 9 1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
npm · ol 8 1:11.6.2-1.24.13.0.0.module+el8.10.0+90779+0cc618fe ELSA-2026-2420 Feb 10, 2026
npm · ol 9 1:11.6.2-1.24.13.0.1.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781 Feb 17, 2026
v8-11.3-devel · amzn 2023 3:11.3.244.8-1.20.20.0.1.amzn2023.0.1 ALAS2023-2026-1402 Feb 5, 2026
v8-12.4-devel · RHEL 8 3:12.4.254.21-1.22.22.0.1.module+el8.10.0+23904+2c92f862 RHSA-2026:2421 Feb 10, 2026
v8-12.4-devel · RHEL 9 3:12.4.254.21-1.22.22.0.1.module+el9.7.0+23896+b5802de9 RHSA-2026:2782 Mar 12, 2026
v8-12.4-devel · almalinux 8 3:12.4.254.21-1.22.22.0.1.module_el8.10.0+4112+db1af44b ALSA-2026:2421 Feb 10, 2026
v8-12.4-devel · almalinux 9 3:12.4.254.21-1.22.22.0.1.module_el9.7.0+208+fb06c0ab ALSA-2026:2782 Feb 17, 2026
v8-12.4-devel · amzn 2023 3:12.4.254.21-1.22.22.0.1.amzn2023.0.1 ALAS2023-2026-1403 Feb 5, 2026
v8-12.4-devel · ol 8 3:12.4.254.21-1.22.22.0.1.module+el8.10.0+90783+325ded07 ELSA-2026-2421 Feb 12, 2026
v8-12.4-devel · ol 9 3:12.4.254.21-1.22.22.0.1.module+el9.7.0+90816+ad59ca7b ELSA-2026-2782 Feb 18, 2026
v8-13.6-devel · RHEL 8 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75 RHSA-2026:7670 Mar 12, 2026
v8-13.6-devel · RHEL 9 3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b RHSA-2026:7350 Mar 12, 2026
v8-13.6-devel · almalinux 8 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42 ALSA-2026:7670 Apr 13, 2026
v8-13.6-devel · almalinux 9 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1 ALSA-2026:7350 Apr 9, 2026
v8-13.6-devel · amzn 2023 3:13.6.233.17-1.24.13.0.1.amzn2023.0.1 ALAS2023-2026-1404 Feb 5, 2026
v8-13.6-devel · ol 8 3:13.6.233.17-1.24.13.0.0.module+el8.10.0+90779+0cc618fe ELSA-2026-2420 Feb 10, 2026
v8-13.6-devel · ol 9 3:13.6.233.17-1.24.13.0.1.module+el9.7.0+90805+68a1aa93 ELSA-2026-2781 Feb 17, 2026
No fix yet
Node.js 10 (Windows apps) No fix yet no-fix n/a
Node.js 12 (Windows apps) No fix yet no-fix n/a
Node.js 14 (Windows apps) No fix yet no-fix n/a
Node.js 15 (Windows apps) No fix yet no-fix n/a
Node.js 16 (Windows apps) No fix yet no-fix n/a
Node.js 17 (Windows apps) No fix yet no-fix n/a
Node.js 18 (Windows apps) No fix yet no-fix n/a
Node.js 19 (Windows apps) No fix yet no-fix n/a
Node.js 4 (Windows apps) No fix yet no-fix n/a
Node.js 6 (Windows apps) No fix yet no-fix n/a
Node.js 7 (Windows apps) No fix yet no-fix n/a
Node.js 8 (Windows apps) No fix yet no-fix n/a

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.