A re-entrancy flaw in the HTTPS module allows an unauthenticated client to read memory from other connections, potentially exposing TLS private keys and other users' requests. The issue occurs when `TLSWrap::DoWrite()` calls `ClearOut()` during a zero-byte write request issued from JavaScript within the HTTP parser's `on body` callback. This causes `ClearOut()` to decrypt the next TLS record while the parser is still processing the body, re-entering `llhttp execute()` and resulting in a use-after-free and an out-of-bounds heap read. Consequently, the server copies freed or unrelated heap memory into the response body. Exploitation requires a handler that calls `res.flushHeaders()` before the request body ends and subsequently calls `res.end()` with a non-empty chunk, combined with a route that echoes or stores a request body.