NODE · CVE-2026-123864 · Runtime
FIX → 26.13.1 · 24.22.3 · 22.23.5 ✓ verified
A re-entrancy bug in Node.js HTTPS can cause a use-after-free and out-of-bounds heap read while a request body is being parsed. An unauthenticated remote client can make the server echo freed or unrelated heap memory back in its response, which may include TLS private keys and other users' requests.
first public Nov 3, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Node.js 22.x, 24.x or 26.x below the fixed releases that serve HTTPS directly from Node. An app is exposed when a handler calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk; an unauthenticated client can then read freed heap memory (possibly TLS private keys or other users' requests) from a route that echoes or stores request bodies. Cleartext node:http servers are not affected, per the advisory.
Not affected if cleartext-node-http, no-flushheaders-handler, tls-terminated-upstream
Who cares https, node.js, self-hosted, tls
node --version. Vulnerable: any 22.x below 22.23.5, 24.x below 24.22.3, 26.x below 26.13.1 (the advisory says all users of these active lines were affected before the fix; it does not give an earlier start version). End-of-life lines are also affected.https.createServer or a framework using it). The advisory says cleartext node:http is not affected.A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 26.13.1 · 24.22.3 · 22.23.5
26.13.1, 24.22.3 or 22.23.5 (released 2026-11-11)tls,http: prevent nested parser execution from empty writesNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.