Bug 2431340 (CVE-2026-21637)
| Summary: | CVE-2026-21637 nodejs: Nodejs denial of service | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | caswilli, kaycoth |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2431457, 2431458, 2431459, 2431460, 2431461, 2431462, 2431463 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-01-20 21:01:51 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:1843 https://access.redhat.com/errata/RHSA-2026:1843 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:1842 https://access.redhat.com/errata/RHSA-2026:1842 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:2422 https://access.redhat.com/errata/RHSA-2026:2422 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:2421 https://access.redhat.com/errata/RHSA-2026:2421 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:2420 https://access.redhat.com/errata/RHSA-2026:2420 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:2781 https://access.redhat.com/errata/RHSA-2026:2781 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:2782 https://access.redhat.com/errata/RHSA-2026:2782 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:2783 https://access.redhat.com/errata/RHSA-2026:2783 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:7350 https://access.redhat.com/errata/RHSA-2026:7350 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:7675 https://access.redhat.com/errata/RHSA-2026:7675 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:7670 https://access.redhat.com/errata/RHSA-2026:7670 |