CVE-2026-21637

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use

NVD CVSS: —
CWE: —
未来 30 天被利用概率: 1.1%
利用等级: 可能（1–10%）
发布时间: —

关联的公开报告 3 份

Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous ExceptionsNode.js · 中危 · 2026-06-12 Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoSNode.js · 中危 · 2026-04-23 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD LeakNode.js · 低危 · 2026-02-12

查看 NVD 详情 ↗