The Node.js project has released a series of security updates that address multiple vulnerabilities. The update covers versions in the 20.x, 22.x, 24.x, and 25.x branches and includes fixes for several high, medium, and low severity issues.
The security rollout March 2026 includes updates to dependencies, such as undici (versions 6.24.1 and 7.24.4) for supported release lines.
One of the most important vulnerabilities fixed is CVE-2026-21637, which is related to a TLS error handling vulnerability.
Node.js: Risk of Remote DoS attack due to CVE-2026-21637
The CVE-2026-21637 vulnerability stems from improper exception handling in the TLS layer. Specifically, the loadSNI() function in _tls_wrap.js lacked a try/catch mechanism . This omission left SNICallback executions vulnerable to unhandled synchronous exceptions .
See also: DarkSword exploit leaked on GitHub
When unexpected input is passed and the callback throws an error, the exception bypasses TLS protection and leads to an uncaught exception. In practice, this can affect a Node.js process, leading to a possible Remote Denial of Service (DoS).
Similar callback pathways, such as ALPN and PSK, had already been secured for CVE-2026-21637, which means it was an incomplete fix of the same vulnerability.
This issue affects all Node.js versions that previously received the CVE-2026-21637 patch, namely 20.x, 22.x, 24.x, and 25.x, particularly in environments where SNICallback can fail on malformed server name inputs.
Severe Vulnerability in Node.js HTTP Handling
Another critical issue, tracked as CVE-2026-21710, affects HTTP request processing.
See also: Citrix NetScaler: Critical vulnerability exposes data
A specially crafted request containing a proto header can cause an uncaught TypeError when applications access req.headersDistinct. This happens because dest[“proto”] resolves to Object.prototype instead of undefined , causing a .push() operation on a non-array object. Since the error is raised inside a property getter, it cannot be caught by standard error handlers.
This makes applications vulnerable unless developers wrap every access in try/catch blocks.
All Node.js HTTP servers running versions 20.x to 25.x are affected.
Medium and Low Severity Issues
Several medium severity vulnerabilities were also addressed in this release: CVE-2026-21711, CVE-2026-21712, CVE-2026-21713, CVE-2026-21714, CVE-2026-21717.
Low severity bugs include: CVE-2026-21715 and CVE-2026-21716.
See also: CISA: Craft CMS vulnerability in KEV Catalog
Impacts and Affected Node.js Versions
The impacts vary slightly depending on the versions:
- Node.js 25.x: 2 high, 5 medium, 2 low severity vulnerabilities
- Node.js 24.x: 2 high, 4 medium, 2 low severity vulnerabilities
- Node.js 22.x: 2 high, 4 medium, 2 low severity vulnerabilities
- Node.js 20.x: 2 high, 4 medium, 2 low severity vulnerabilities
The project has released updated versions to address these issues: Node.js v20.20.2 Node.js v22.22.2 Node.js v24.14.1 Node.js v25.8.2.
