CVE-2026-21637

A bug has been identified in Node.js error handling where 'Maximum call stack size exceeded' errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications relying on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. Applications calling socket.getPeerCertificate(true) leak memory per certificate field, allowing remote clients to trigger steady memory growth through repeated TLS connections.

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs, potentially allowing an adversary to remotely crash a Node.js runtime.

A memory leak occurs in Node.js when a remote peer abruptly closes the socket without sending a GOAWAY notification, or when nghttp2 detects an invalid header and terminates the connection. This can lead to increased memory consumption and potential denial of service.

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API, allowing malicious actors to retrieve stats from files they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.

A flaw in Node.js allows bypassing network import restrictions by embedding non-network imports in data URLs. This enables an attacker to execute arbitrary code and compromise system security.

A critical vulnerability was identified in the HTTP server of the most recent Node version, where malformed headers can lead to HTTP request smuggling. Specifically, placing a space before a content-length header causes it to be misinterpreted, enabling attackers to smuggle a second request within the body of the first.

An attacker can make a Node.js HTTP/2 server completely unavailable by sending a small number of HTTP/2 frame packets. Data can remain in nghttp2 memory after a reset when headers with an HTTP/2 CONTINUATION frame are sent and the client abruptly closes the TCP connection, triggering a race condition.

Node.js versions 4.0.0, 4.1.0, and 4.1.1 allow remote attackers to cause a denial of service.

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to '..' handling was incompatible with the pathname validation used by unspecified community modules.