{"id":"CVE-2026-123864","kind":"vulnerability","aliases":["CVE-2026-123864"],"related":[],"title":"Node.js HTTPS: re-entrancy flaw leaks other connections' memory and TLS keys","description":"A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","summary":"A re-entrancy bug in Node.js HTTPS can cause a use-after-free and out-of-bounds heap read while a request body is being parsed. An unauthenticated remote client can make the server echo freed or unrelated heap memory back in its response, which may include TLS private keys and other users' requests.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":["22.23.5","24.22.3","26.13.1"],"affected":"22.x < 22.23.5, 24.x < 24.22.3, 26.x < 26.13.1","ecosystem":"npm"}],"ecosystems":[],"tags":["https","node.js","runtime","self-hosted","tls"],"not_affected_if":["cleartext-node-http","no-flushheaders-handler","tls-terminated-upstream"],"how_to_check":"- Run `node --version`. Vulnerable: any 22.x below 22.23.5, 24.x below 24.22.3, 26.x below 26.13.1 (the advisory says all users of these active lines were affected before the fix; it does not give an earlier start version). End-of-life lines are also affected.\n- Check whether the app terminates TLS in Node (`https.createServer` or a framework using it). The advisory says cleartext node:http is not affected.\n- Look for handlers that call res.flushHeaders() before the request body ends and later res.end() with a non-empty chunk. Reading leaked memory needs any route that echoes or stores request bodies.","fix":"Upgrade Node.js to 26.13.1, 24.22.3 or 22.23.5 (released 2026-11-11). Fix: 'tls,http: prevent nested parser execution from empty writes'. End-of-life lines are also affected and have no fix; move to a supported line.","status":"open","published_at":"2026-11-11T19:17:32+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","triaged_at":"2026-11-11T19:29:56+00:00","updated_at":"2026-11-11T19:33:36+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-11-11T19:29:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Node.js HTTPS: re-entrancy flaw leaks other connections' memory and TLS keys","impact":"high","summary":"A re-entrancy bug in Node.js HTTPS can cause a use-after-free and out-of-bounds heap read while a request body is being parsed. An unauthenticated remote client can make the server echo freed or unrelated heap memory back in its response, which may include TLS private keys and other users' requests.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["node.js","https","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote client reads TLS private keys and other users' requests from memory.","analyst_note":"Fixed Node.js versions are not given in the sources; check the Node.js security release notes for CVE-2026-123864 to fill fix and fix_status.","how_to_check":"- Run `node --version` and compare against the affected lines 26.x, 24.x and 22.x.\n- Check whether the app uses `https` (TLS) rather than cleartext `node:http`; only HTTPS is described as affected.\n- Look for handlers that call `res.flushHeaders()` before the request body ends and then `res.end()` with a non-empty chunk, and for routes that echo or store request bodies.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["cleartext-node-http","tls-terminated-upstream","no-flushheaders-handler"],"who_is_affected":"Servers running Node.js 26.x, 24.x or 22.x that serve HTTPS directly. Exposure requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading leaked memory is easiest where a route echoes or stores request bodies. Cleartext node:http servers and HTTPS terminated in front by a proxy are described as unaffected or not stated, so teams may skip or verify those cases.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000847,"input_tokens":4776,"output_tokens":738,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed Node.js versions are not given in the sources; check the Node.js security release notes for CVE-2026-123864 to fill fix and fix_status.","search":"'-123864':16A,19A '-2026':15A,18A '22':243C '24':240C '26':238C 'affect':233C,236C 'ask':117C 'back':71B 'belong':99C 'bodi':53B,136C,151C,188C,200C,227C 'bound':47B,169C 'bug':32B 'byte':121C 'call':113C,195C,204C 'callback':137C 'caus':37B,158C 'chunk':211C 'clearout':114C,138C 'cleartext':228C 'client':60B,96C 'connect':9A,102C 'copi':175C 'cve':14A,17A 'decrypt':139C 'direct':115C 'dowrit':112C 'echo':65B,222C 'empti':210C 'end':201C 'enter':154C 'entranc':5A,31B,88C 'execut':156C 'flaw':6A,89C 'free':42B,163C 'freed':66B,177C 'handler':193C 'heap':48B,69B,170C,180C 'host':26B 'http':132C,230C 'https':2A,21B,35B,92C 'includ':77B,103C 'insid':130C 'issu':126C 'javascript':128C 'key':13A,80B,106C 'later':203C 'leak':7A,215C 'let':93C 'llhttp':155C 'make':62B 'may':76B 'memori':10A,70B,98C,181C,216C 'mid':150C 'mid-bodi':149C 'next':141C 'node':20A,229C 'node.js':1A,22B,34B,91C,237C 'non':209C 'non-empti':208C 'ordinari':219C 'out-of-bound':44B,166C 'pars':56B 'parser':133C,146C 'privat':79B,105C 're':4A,30B,87C,153C 're-ent':152C 're-entr':3A,29B,86C 'read':49B,97C,171C,213C 'record':143C 'remot':59B 'request':52B,84B,110C,187C,199C,226C 'requir':191C,217C 'res.end':205C 'res.flushheaders':196C 'respons':74B,184C 'rout':220C 'run':129C 'runtim':23B 'self':25B 'self-host':24B 'server':64B,173C 'still':148C 'store':224C 'tls':12A,27B,78B,104C,142C 'tlswrap':111C 'trigger':189C 'unauthent':58B,95C 'unrel':68B,179C 'use':40B,161C 'use-after-fre':39B,160C 'user':83B,109C 'vulner':235C 'write':119C,124C 'x':239C,241C,244C 'zero':120C","nicknames":[],"mitigations":[],"who_affected":"Servers running Node.js 22.x, 24.x or 26.x below the fixed releases that serve HTTPS directly from Node. An app is exposed when a handler calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk; an unauthenticated client can then read freed heap memory (possibly TLS private keys or other users' requests) from a route that echoes or stores request bodies. Cleartext node:http servers are not affected, per the advisory.","tier":"B","verified":{"fix":{"at":"2026-11-11T19:33:36Z","by":"analyst","doc":"https://nodejs.org/en/blog/release/v22.23.5","run_id":3588},"products":{"at":"2026-11-11T19:33:36Z","by":"analyst","doc":"https://nodejs.org/en/blog/release/v22.23.5","run_id":3588},"who_affected":{"at":"2026-11-11T19:33:36Z","by":"analyst","doc":"https://nodejs.org/en/blog/release/v22.23.5","run_id":3588}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["node"],"ptokens":["node"],"labels":["high","https","nodejs","runtime","selfhosted","tls"],"campaign_type":null,"search_a":"'-123864':16A,19A '-2026':15A,18A 'connect':9A 'cve':14A,17A 'entranc':5A 'flaw':6A 'https':2A 'key':13A 'leak':7A 'memori':10A 'node':20A 'node.js':1A 're':4A 're-entr':3A 'tls':12A","search_b":"'back':71B 'bodi':53B 'bound':47B 'bug':32B 'caus':37B 'client':60B 'echo':65B 'entranc':31B 'free':42B 'freed':66B 'heap':48B,69B 'host':26B 'https':21B,35B 'includ':77B 'key':80B 'make':62B 'may':76B 'memori':70B 'node.js':22B,34B 'out-of-bound':44B 'pars':56B 'privat':79B 're':30B 're-entr':29B 'read':49B 'remot':59B 'request':52B,84B 'respons':74B 'runtim':23B 'self':25B 'self-host':24B 'server':64B 'tls':27B,78B 'unauthent':58B 'unrel':68B 'use':40B 'use-after-fre':39B 'user':83B","search_c":"'22':243C '24':240C '26':238C 'affect':233C,236C 'ask':117C 'belong':99C 'bodi':136C,151C,188C,200C,227C 'bound':169C 'byte':121C 'call':113C,195C,204C 'callback':137C 'caus':158C 'chunk':211C 'clearout':114C,138C 'cleartext':228C 'client':96C 'connect':102C 'copi':175C 'decrypt':139C 'direct':115C 'dowrit':112C 'echo':222C 'empti':210C 'end':201C 'enter':154C 'entranc':88C 'execut':156C 'flaw':89C 'free':163C 'freed':177C 'handler':193C 'heap':170C,180C 'http':132C,230C 'https':92C 'includ':103C 'insid':130C 'issu':126C 'javascript':128C 'key':106C 'later':203C 'leak':215C 'let':93C 'llhttp':155C 'memori':98C,181C,216C 'mid':150C 'mid-bodi':149C 'next':141C 'node':229C 'node.js':91C,237C 'non':209C 'non-empti':208C 'ordinari':219C 'out-of-bound':166C 'parser':133C,146C 'privat':105C 're':87C,153C 're-ent':152C 're-entr':86C 'read':97C,171C,213C 'record':143C 'request':110C,187C,199C,226C 'requir':191C,217C 'res.end':205C 'res.flushheaders':196C 'respons':184C 'rout':220C 'run':129C 'server':173C 'still':148C 'store':224C 'tls':104C,142C 'tlswrap':111C 'trigger':189C 'unauthent':95C 'unrel':179C 'use':161C 'use-after-fre':160C 'user':109C 'vulner':235C 'write':119C,124C 'x':239C,241C,244C 'zero':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T23:00:00+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123864","severity":null,"published_at":"2026-11-11T19:17:32+00:00","modified_at":"2026-11-11T19:17:32+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","fetched_at":"2026-11-11T19:28:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123864:3588","url":"https://nodejs.org/en/blog/release/v26.13.1","severity":null,"published_at":"2026-11-11T19:33:36+00:00","modified_at":"2026-11-11T19:33:36+00:00","first_seen_at":"2026-11-11T19:33:36+00:00","fetched_at":"2026-11-11T19:33:36+00:00","note":"Node.js Nov 11 2026 security release advisory and release posts confirm fixes 26.13.1/24.22.3/22.23.5; no exploitation or PoC seen (social not searched). Exact first affected version not stated. Sibling CVEs (123863/5/6/72) in same release.","cites":["https://nodejs.org/en/blog/release/v26.13.1","https://nodejs.org/en/blog/release/v24.22.3","https://nodejs.org/en/blog/release/v22.23.5"]}],"documents":[{"id":65753,"url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases","title":"Node.js November 11, 2026 Security Releases","kind":"advisory","source":"advisory","publisher":null,"text":"Wednesday, November 11, 2026 Security Releases","published_at":"2026-11-03T23:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":128323,"url":"https://nodejs.org/en/blog/release/v26.13.1","title":"Node.js 26.13.1 (LTS)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":128317,"url":"https://nodejs.org/en/blog/release/v24.22.3","title":"Node.js 24.22.3 (LTS)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":128327,"url":"https://nodejs.org/en/blog/release/v22.23.5","title":"Node.js 22.23.5 (LTS)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}