CVE-2026-123864 Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parser
Unauthenticated clients can read other connections' memory, including TLS private keys, from Node.js HTTPS servers using certain request handling patterns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- Yes
- Fix
- Available
What is CVE-2026-123864?
CVE-2026-123864 is a high-severity use after free vulnerability in nodejs node, published on 11 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Weakness: CWE-416
Which versions are affected by CVE-2026-123864?
An affected version is only exploitable if your software calls TLSWrap::DoWrite(), ClearOut() or llhttp_execute(). Many projects that include it are not exposed.
How do I fix CVE-2026-123864?
No fix published yet.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-123864 being exploited?
There is no known exploitation of CVE-2026-123864 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-123864, BELL-CVE-2026-123864, DEBIAN-CVE-2026-123864, GHSA-m526-rv55-w6mr, UBUNTU-CVE-2026-123864.