CVE-2026-21637: nodejs node Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-21637 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in nodejs node. EPSS estimates a 1.12% chance of exploitation in the next 30 days, higher than 66.1% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 44 · Related 22Timeline
- 20-01-2026PublishedVulnerability first disclosed.
- 21-01-2026Last modifiedVulnerability information updated.
Description
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
CVSS metrics
9 scores · 7 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.12%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
Decrease -0.02 pp
From 1.14% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard12 products
- eco-nodejs-20.9.0All versions (No fix recorded)
- nodejs-16All versions (No fix recorded)
- nodejs-18All versions (No fix recorded)
- nodejs-20< 20.20.0-r0
- nodejs-20-doc< 20.20.0-r0
Wolfi11 products
- nodejs-16All versions (No fix recorded)
- nodejs-18All versions (No fix recorded)
- nodejs-20< 20.20.0-r0
- nodejs-20-doc< 20.20.0-r0
- nodejs-21All versions (No fix recorded)
Nodejs2 products
- node20.19.6 | 22.21.1 | 24.12.0 | 25.2.1 | ≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.* | ≥ 17.0, < 17.* | ≥ 18.0, < 18.*
- node.js≥ 4.0.0, < 20.20.0 | ≥ 22.0.0, < 22.22.0 | ≥ 24.0.0, < 24.13.0 | ≥ 25.0.0, < 25.3.0
Alpine1 product
- nodejs< 22.22.2-r0 | < 24.14.1-r0
Debian1 product
- nodejs< 18.20.4+dfsg-1~deb12u2 | < 20.19.2+dfsg-1+deb13u2 | < 22.22.2+dfsg+~cs22.19.15-1
Ubuntu1 product
- nodejsAll versions (No fix recorded)
6 vendors · 28 products
