Homepage

Uncaught Exception The advisory has been revoked - it doesn't affect any version of package nodejs24.src  (opens in a new tab)

Threat Intelligence

EPSS
0.04% (14th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS10-NODEJS24SRC-15045442
  • published21 Jan 2026
  • disclosed20 Jan 2026
Report a new vulnerability Found a mistake?

Introduced: 20 Jan 2026

CVE-2026-21637  (opens in a new tab)
CWE-248  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs24.src package and not the nodejs24.src package as distributed by Centos.

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.