Node.js Fixes Critical TLS Bug Enabling DoS Attacks

Node.js has released a critical security update to address multiple vulnerabilities that could allow attackers to crash applications or trigger denial-of-service (DoS) conditions. The update, published on March 24, 2026, upgrades the Long-Term Support (LTS) version to 20.20.2, codenamed “Iron,” and resolves several security flaws affecting core components such as TLS, HTTP/2, the V8 engine, and the platform’s permission model.

The most severe vulnerability, tracked as CVE-2026-21637, has been rated High due to its potential for remote exploitation. The issue originates from improper error handling in the SNICallback function, which is used during TLS handshakes to determine the appropriate certificate. Security researchers found that a specially crafted server name sent by a malicious client could trigger a synchronous exception that bypasses standard error-handling mechanisms. As a result, the exception remains uncaught and causes the entire Node.js process to terminate unexpectedly.

This flaw is particularly concerning because it can be exploited without authentication, making publicly exposed servers especially vulnerable. An attacker could repeatedly trigger the issue to crash services, effectively causing sustained denial-of-service conditions and disrupting business-critical applications.