Use-After-Destroy Vulnerability in Node.js TLS Server Handshake Handling

CVE-2026-126051

What is CVE-2026-126051?

A use-after-destroy vulnerability exists in the TLS server handshake handling within Node.js. This flaw enables an unauthenticated remote attacker to terminate the server process. The issue arises when OpenSSL callbacks associated with TLS server operations—such as SNICallback, OCSPRequest, newSession, or resumeSession—are deferred. If an attacker crafts a malicious client hello that targets this vulnerability pathway (for instance, by omitting SNI alongside an OCSP request), combined with specific socket manipulation, it can lead to a situation where the associated socket gets destroyed prior to the execution of the deferred callback. Consequently, this results in an uncaught exception, disrupting server operation and potentially leading to denial of service.

References