---
id: "CVE-2026-123864"
page: "https://infrastack.ai/live/CVE-2026-123864"
kind: "vulnerability"
aliases: ["CVE-2026-123864"]
title: "Node.js HTTPS: re-entrancy flaw leaks other connections' memory and TLS keys"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "node", "fixed": ["22.23.5", "24.22.3", "26.13.1"], "affected": "22.x < 22.23.5, 24.x < 24.22.3, 26.x < 26.13.1", "ecosystem": "npm"}]
ecosystems: []
tags: ["https", "node.js", "runtime", "self-hosted", "tls"]
not_affected_if: ["cleartext-node-http", "no-flushheaders-handler", "tls-terminated-upstream"]
published_at: "2026-11-11T19:17:32+00:00"
first_seen_at: "2026-11-11T19:28:45+00:00"
updated_at: "2026-11-11T19:33:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123864", "first_seen_at": "2026-11-11T19:28:45+00:00"}, {"source": "analyst", "url": "https://nodejs.org/en/blog/release/v26.13.1", "first_seen_at": "2026-11-11T19:33:36+00:00", "cites": ["https://nodejs.org/en/blog/release/v26.13.1", "https://nodejs.org/en/blog/release/v24.22.3", "https://nodejs.org/en/blog/release/v22.23.5"]}]
exploit_sources: []
---

# Node.js HTTPS: re-entrancy flaw leaks other connections' memory and TLS keys

Link for people: https://infrastack.ai/live/CVE-2026-123864 (this .md is for agents)

A re-entrancy bug in Node.js HTTPS can cause a use-after-free and out-of-bounds heap read while a request body is being parsed. An unauthenticated remote client can make the server echo freed or unrelated heap memory back in its response, which may include TLS private keys and other users' requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:node affected 22.x < 22.23.5, 24.x < 24.22.3, 26.x < 26.13.1 fixed 22.23.5, 24.22.3, 26.13.1

## How to check

- Run `node --version`. Vulnerable: any 22.x below 22.23.5, 24.x below 24.22.3, 26.x below 26.13.1 (the advisory says all users of these active lines were affected before the fix; it does not give an earlier start version). End-of-life lines are also affected.
- Check whether the app terminates TLS in Node (`https.createServer` or a framework using it). The advisory says cleartext node:http is not affected.
- Look for handlers that call res.flushHeaders() before the request body ends and later res.end() with a non-empty chunk. Reading leaked memory needs any route that echoes or stores request bodies.

## Fix

Upgrade Node.js to 26.13.1, 24.22.3 or 22.23.5 (released 2026-11-11). Fix: 'tls,http: prevent nested parser execution from empty writes'. End-of-life lines are also affected and have no fix; move to a supported line.

## Timeline

- 2026-11-11T19:28:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123864
- 2026-11-11T19:33:36+00:00 analyst https://nodejs.org/en/blog/release/v26.13.1 — Node.js Nov 11 2026 security release advisory and release posts confirm fixes 26.13.1/24.22.3/22.23.5; no exploitation or PoC seen (social not searched). Exact first affected version not stated. Sibling CVEs (123863/5/6/72) in same release.

## Documents

- [advisory] Node.js November 11, 2026 Security Releases https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
- [fix] Node.js 26.13.1 (LTS) https://nodejs.org/en/blog/release/v26.13.1
- [fix] Node.js 24.22.3 (LTS) https://nodejs.org/en/blog/release/v24.22.3
- [fix] Node.js 22.23.5 (LTS) https://nodejs.org/en/blog/release/v22.23.5

## From the sources

A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_