CVE-2026-123864
Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parser
Description
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
INFO
Published Date :
Nov. 11, 2026, 6:17 p.m.
Last Modified :
Nov. 11, 2026, 6:17 p.m.
Remotely Exploit :
Yes !
Source :
openjs
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.0 | HIGH | ce714d77-add3-4f53-aff5-83d477b104bb | ||||
| CVSS 3.0 | HIGH | MITRE-CVE |
Solution
- Update Node.js to a version that includes the fix.
- Apply security patches from the Node.js project.
- Avoid writing zero bytes in TLS connections.
- Ensure request body handling is secure.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-123864 vulnerability anywhere in the article.