CVE-2026-126051

{
  "etk_id": "ETK-2026-4202",
  "cve_id": "CVE-2026-126051",
  "display_id": "CVE-2026-126051",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-123706",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Use-after-destroy in Node.js TLS handshake callbacks",
  "summary": "Node.js 24.x and 26.x TLS servers are affected when they use SNICallback, OCSPRequest, newSession, resumeSession, or server.addContext(). A remote unauthenticated client can trigger an unhandled exception that terminates the Node.js process by racing connection teardown with one of these deferred callbacks.",
  "mitigation": "Upgrade Node.js 24.x to 24.22.3 or later, or Node.js 26.x to 26.13.1 or later. Until upgrades are complete, avoid the affected TLS callbacks and additional TLS contexts where operationally possible.",
  "vendor": "nodejs",
  "product": "node",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 24.0.0, < 24.22.3",
        ">= 25.0.0, < 26.13.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "24.22.3",
        "26.13.1"
      ],
      "package_name": "node",
      "purl": null
    }
  ],
  "cwes": [
    476
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-11-11T18:35:45.777000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T18:35:45.777000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T18:35:45.777000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-126051"
    }
  }
}