{"id":"EM-20261111-PQ5E","url":"https://cyber.eventmonitor.net/incident/EM-20261111-PQ5E/node-js-tls-vulnerability-cve-2026-126051/","type":"cve","title":"Node.js TLS Vulnerability (CVE-2026-126051)","subtitle":"CVE-2026-126051","subject":"CVE-2026-126051","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-11T19:17:36.600Z","firstSignal":"2026-11-11T18:35:45.000Z","lastSignal":"2026-11-11T19:17:36.600Z","updated":"2026-11-12T00:31:06.720Z","revision":1,"life":[{"status":"Born","at":"2026-11-11T19:17:36.600Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-11T19:17:36.600Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-11T18:35:45.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-11T19:17:36.600Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261111-PQ5E created."}],"stages":[{"name":"Disclosed","at":"2026-11-11T19:17:36.600Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-11T19:17:36.600Z","detail":"CVSS 7.5"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-11T18:35:45.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-11T18:35:45.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-126051 (important)","text":"nodejs: nodejs: Denial of service via premature socket closure during TLS handshake","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-126051.json"},{"at":"2026-11-11T19:17:36.600Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-126051 (CVSS 7.5)","text":"A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126051"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-11T19:17:36.600","score":7.5,"severity":"HIGH","desc":"A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding…","product":"","seen":1794435185345},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}