🎯 New Report #3556769: Incomplete fix for CVE-2026-21637: loadSNI() in tls wrap.js lacks try/catch leading to Remote DoS
🔺Severity: High
👽 Reporter: mbarbs
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-02-15
⏰ Disclosed: 2026-04-23 22:21:16
📝 Summary: A flaw was discovered in the Node.js TLS error handling that left SNICallback invocations unprotected against synchronous exceptions. This represented an incomplete fix of the prior CVE-2026-21637 vulnerability, where the equivalent ALPN and PSK callbacks were already addressed. The issue could lead to a Remote Denial of Service when an SNICallback threw synchronously on unexpected input, causing the exception to bypass TLS error handlers and propagate as an uncaught exception, crashing the Node.js process.
📂 Report JSON File: 3556769
@hackeronereports