Node.js: Cross-connection memory disclosure via TLS write re-entrancy
Summary
Node.js HTTPS servers can leak heap memory belonging to other connections, including TLS private keys and other users' requests. A zero-length TLS write issued from JavaScript inside the HTTP parser's on_body callback re-enters the parser, causing a use-after-free and an out-of-bounds heap read. An unauthenticated remote client can trigger this if the application calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and any route that echoes or stores request bodies can return the leaked data. Cleartext node:http is not affected.
Affected
- Node.js 22.x before 22.23.5
- Node.js 24.x before 24.22.3
- Node.js 26.x before 26.13.1
- Earlier release lines are also in the affected range; no fix is provided for end-of-life lines.
Fixed in
- Node.js 22.23.5
- Node.js 24.22.3
- Node.js 26.13.1
Workaround
Unknown. The vendor documents no workaround; upgrading is the only documented remedy. Cleartext node:http is not affected.
Exploitation
- No public proof of concept or confirmed exploitation known at time of writing.
- VulDB labels the entry as 0-Day in its own status field; this does not confirm exploitation.
- CVSS 8.1 (NVD-format record, CVSS 3.0 vector); VulDB scores it 7.3.
Our recommendation
- Inventory all Node.js runtimes (node -v) on servers, containers, CI runners and single-executable binaries.
- Upgrade to 22.23.5, 24.22.3 or 26.13.1 and rebuild Docker images and binaries on the fixed version.
- Prioritise internet-facing Node.js services that serve HTTPS directly, and check whether they use the flushHeaders and res.end pattern and echo request bodies.
- If TLS private keys may have leaked, reissue and rotate the affected certificates.
- Upgrade the whole runtime; the same release also fixes other vulnerabilities, including CVE-2026-123865.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenJS CNA Security Advisories cna.openjsf.org
- Node.js November 2026 Security Releases nodejs.org
- Node.js 26.13.1 release notes nodejs.org
- Node.js 22.23.5 release notes github.com
- Node.js 24.22.3 release notes github.com
- VulDB entry 435936 vuldb.com
- Security Online: Node.js HTTP/2 and TLS vulnerabilities, November 2026 securityonline.info
- CVE-2026-123864 mirror record cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:28.
Original description (NVD)
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.