A flaw in Node.js TLS error handling permits remote attackers to crash or exhaust resources of a TLS server when PSK or ALPN callbacks are active. Synchronous exceptions thrown during these callbacks bypass the standard TLS error paths, causing immediate process termination or silent file descriptor leaks that progress to denial of service. The weakness originates from unchecked return values and improper error handling, exposing the server to denial of service through attacker‑controlled TLS handshake input.

Any deployment of Node.js that employs PSK or ALPN callback functions within its TLS server is vulnerable. The impact applies across all Node.js versions where these callbacks are not safely wrapped, as no specific version boundaries are listed. Systems that expose TLS services and rely on user‑supplied callbacks during the handshake are at risk.

The vulnerability carries a CVSS score of 7.5, indicating high severity, but the EPSS score is below 1 %, suggesting low exploitation probability at present. It is not catalogued in the CISA KEV list. The likely attack vector is a remote TLS client that requests a session using PSK or ALPN, delivering crafted input to trigger a callback exception. When triggered, the server either terminates or leaks file descriptors, leading to resource exhaustion and denial of service. No special privileges or local access are required to exploit the flaw.