CVE-2026-111500: Node.js TLS ALPN Callback Race Condition
A race condition in Node.js TLS socket initialization when custom ALPNCallback handlers interact with asynchronous SNI context resolution can cause use-after-free memory corruption under concurrent TLS handshakes.
Executive Summary & Technical Impact
A race condition in Node.js TLS socket initialization when custom ALPNCallback handlers interact with asynchronous SNI context resolution can cause use-after-free memory corruption under concurrent TLS handshakes.
Tracked under CVE-2026-111500 (CWE-362 (Concurrent Execution using Shared Resource / Race Condition)), this vulnerability affects Node.js 22.x, 24.x, 25.x / 26.x and carries a severity score of 8.1 (HIGH). Engineering and security operations teams running Node.js Runtime should prioritize upgrading to Node.js v22.22.4+, v24.16.0+, v25.10.0+ / v26.12.1+.
Remediation & Patch Guidance
- Upgrade Node.js to the October 2026 security release line across all TLS-terminating Node.js servers.
- Avoid mutating shared TLS SecureContext buffers inside custom ALPNCallback hooks.
Frequently Asked Questions (CVE-2026-111500)
What versions are affected by CVE-2026-111500?
CVE-2026-111500 affects Node.js 22.x, 24.x, 25.x / 26.x in Node.js Runtime (Node.js TLS ALPN Callback Race Condition).
How do I patch or remediate CVE-2026-111500?
Upgrade affected deployments to Node.js v22.22.4+, v24.16.0+, v25.10.0+ / v26.12.1+ and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-111500?
CVE-2026-111500 is rated HIGH with a CVSS score of 8.1 (vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Node.js October 2026 Security Emergency: Brotli RCE (CVE-2026-111497) & TLS Validation Bypass
A deep technical breakdown of the October 2026 Node.js security releases addressing a critical out-of-bounds write in the bundled Brotli decoder and NUL byte DNS truncation.
Read full engineering post-mortem (7 min read) →