CVE-2026-123864

Name of the Vulnerable Software and Affected Versions Node.js versions 26.x through 26.13.0 Node.js versions 24.x through 24.22.2 Node.js versions 22.x through 22.23.4

Description A re-entrancy flaw in the HTTPS module allows an unauthenticated client to read memory from other connections, potentially exposing TLS private keys and other users' requests. The issue occurs when TLSWrap::DoWrite() calls ClearOut() during a zero-byte write request issued from JavaScript within the HTTP parser's on body callback. This causes ClearOut() to decrypt the next TLS record while the parser is still processing the body, re-entering llhttp execute() and resulting in a use-after-free and an out-of-bounds heap read. Consequently, the server copies freed or unrelated heap memory into the response body. Exploitation requires a handler that calls res.flushHeaders() before the request body ends and subsequently calls res.end() with a non-empty chunk, combined with a route that echoes or stores a request body.

Recommendations Update Node.js 26.x to version 26.13.1. Update Node.js 24.x to version 24.22.3. Update Node.js 22.x to version 22.23.5.