Node.js patches nine vulnerabilities across active releases

Summary

CVE-2026-21637 incomplete fix and __proto__ header handling affect any TLS server or HTTP server receiving untrusted input—both bypass error handlers entirely, making them unrecoverable without process restart. The HMAC timing oracle and HashDoS in JSON.parse() widen attack surface for cryptographic forgery and DoS.

Why it matters

CVE-2026-21637 incomplete fix and __proto__ header handling affect any TLS server or HTTP server receiving untrusted input—both bypass error handlers entirely, making them unrecoverable without process restart. The HMAC timing oracle and HashDoS in JSON.parse() widen attack surface for cryptographic forgery and DoS.

Sources

1. 1.Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637) - (High)
2. 2.This security release includes the following dependency updates to address public vulnerabilities: undici (6.24.1, 7.24.4) on 22.x, 24.x, 25.x
3. 3.2 high severity issues. 5 medium severity issues. 2 low severity issues.
4. 4.When an SNICallback throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception, crashing the Node.js process.
5. 5.When this occurs, dest["__proto__"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array.