Quick answers
- Is CVE-2026-126051 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-126051 being exploited in the wild.
- How severe is CVE-2026-126051?
- High severity, with a CVSS score of 7.5, published 11 November 2026.
- Which products and versions are affected?
- OpenJS Foundation Node.js 26.x, 24.x.
- Is there a fix for CVE-2026-126051?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-126051 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-126051?
- Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-destroy flaw in deferred OpenSSL callback handling allows a remote, unauthenticated attacker to trigger an uncaught exception in Node.js TLS servers. When SNICallback, OCSPRequest, newSession, resumeSession hooks, or server.addContext() are used, the corresponding callbacks are deferred; if the underlying socket is destroyed between scheduling and execution, the deferred code attempts to operate on destroyed memory. An attacker sends a client hello that triggers the vulnerable path (e.g., no SNI with OCSP request) followed by padding and a socket FIN, causing OpenSSL to deliver both the client hello and EOF in the same event loop tick, destroying the socket before the callback executes.
Affected products
- OpenJS Foundation Node.js 26.x, 24.x
Timeline
- 2026-11-11: disclosed