Node.js · Report #3824331
Null Dereference in X509ToObject
Validstatus
mediumseverity
22upvotes
23 Oct 2026disclosed
Summary
A null pointer dereference in Node.js X.509 certificate handling could cause the process to crash when converting a specially crafted certificate to a JavaScript object through X509ToObject.
An attacker able to supply or influence certificate data consumed by an affected application could trigger a denial of service by causing the Node.js process to terminate.
This vulnerability affects Node.js 24.x and 26.x.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.