AIKIDO-2026-10034
node is vulnerable to Denial of Service (DoS)
50
Medium Risk
This Affects:
nodeTL;DR
Affected versions of the package are vulnerable to denial-of-service conditions due to improper TLS error handling when pskCallback or ALPNCallback are used. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), resulting in either immediate process termination or silent file descriptor leaks that can exhaust resources over time. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
node is vulnerable to Denial of Service (DoS) in versions 25.0.0 - 25.2.0, 23.0.0 - 24.12.0, 21.0.0 - 22.21.1 and 0.0.1 - 20.19.6.
How to fix this
Upgrade the node library to a patch version.
Links
nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---mediumnodejs.org/en/blog/vulnerability/december-2025-security-releases
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant