Files
node/test/parallel
Matteo Collina cc3f294507 tls: wrap SNICallback invocation in try/catch
Wrap the owner._SNICallback() invocation in loadSNI() with try/catch
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This completes the fix from CVE-2026-21637
which added try/catch protection to callALPNCallback,
onPskServerCallback, and onPskClientCallback but missed loadSNI().

Without this fix, a remote unauthenticated attacker can crash any
Node.js TLS server whose SNICallback may throw on unexpected input
by sending a single TLS ClientHello with a crafted server_name value.

Fixes: https://hackerone.com/reports/3556769
Refs: https://hackerone.com/reports/3473882
CVE-ID: CVE-2026-21637
PR-URL: https://github.com/nodejs-private/node-private/pull/839
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21637
2026-03-20 17:45:06 +01:00
..
2025-11-19 18:01:43 +01:00
2023-08-17 08:36:01 -03:00
2023-08-17 08:36:01 -03:00
2026-03-04 10:41:45 +01:00
2023-08-17 08:36:01 -03:00
2023-08-17 08:36:01 -03:00
2024-08-19 10:32:23 +02:00
2023-12-19 16:17:36 +00:00
2023-02-21 15:33:28 +00:00
2023-05-30 11:36:13 +02:00
2023-08-17 08:36:01 -03:00
2023-08-17 08:36:01 -03:00
2023-11-11 19:34:08 +01:00
2024-06-17 13:32:40 +02:00