CVE-2026-123864

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123864", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-11-06T16:13:33.715Z", "datePublished": "2026-11-11T18:17:56.773Z", "dateUpdated": "2026-11-11T18:17:56.773Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-11-11T18:17:56.773Z"}, "title": "Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parser", "descriptions": [{"lang": "en", "value": "A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.", "supportingMedia": [{"type": "text/markdown", "base64": false, "value": "A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. `TLSWrap::DoWrite()` calls `ClearOut()` directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's `on_body` callback, `ClearOut()` decrypts the next TLS record while the parser is still mid-body, re-entering `llhttp_execute()` and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls `res.flushHeaders()` before the request body ends and later calls `res.end()` with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext `node:http` is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}]}], "credits": [{"lang": "en", "value": "Chris Rohlf in collaboration with Claude and Anthropic Research", "type": "reporter"}, {"lang": "en", "value": "mcollina", "type": "remediation developer"}, {"lang": "en", "value": "ShogunPanda", "type": "remediation reviewer"}, {"lang": "en", "value": "pimterry", "type": "remediation reviewer"}, {"lang": "en", "value": "aduh95", "type": "coordinator"}], "affected": [{"vendor": "nodejs", "product": "node", "defaultStatus": "unaffected", "versions": [{"version": "0.0.0", "status": "affected", "lessThan": "22.23.5", "versionType": "semver"}, {"version": "23.0.0", "status": "affected", "lessThan": "24.22.3", "versionType": "semver"}, {"version": "25.0.0", "status": "affected", "lessThan": "26.13.1", "versionType": "semver"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "Use After Free"}]}], "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases", "tags": ["vendor-advisory"]}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "x_generator": {"engine": "nodejs-private/security-release publish-cves"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "node", "vendor": "nodejs", "versions": [{"lessThan": "22.23.5", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "24.22.3", "status": "affected", "version": "23.0.0", "versionType": "semver"}, {"lessThan": "26.13.1", "status": "affected", "version": "25.0.0", "versionType": "semver"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}], "id": "CVE-2026-123864", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 5.3, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}, "published": "2026-11-11T19:17:32.790", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{"bugzilla": {"description": "nodejs: nodejs: Information disclosure via HTTPS parser re-entrancy", "id": "2571836", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571836"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-1265", "details": ["A flaw was found in Node.js. An unauthenticated remote attacker can exploit a re-entrancy vulnerability in the HTTPS server to cause memory corruption and read memory belonging to other connections. Under specific request handling conditions, processing incoming encrypted data while the HTTP parser is active causes freed or out-of-bounds heap memory to be read and returned to the client. This flaw leads to information disclosure, potentially exposing sensitive data such as other users' requests and Transport Layer Security (TLS) private keys."], "mitigation": {"lang": "en:us", "value": "Offload TLS termination to a trusted reverse proxy or load balancer, and configure the Node.js application to serve traffic over cleartext HTTP bound only to localhost (127.0.0.1), as cleartext HTTP is not affected by this flaw.\nIf TLS must remain terminated by the Node.js process, restrict network access to trusted hosts using firewall rules to limit exposure:\n# firewall-cmd --permanent --zone=internal --add-port=<PORT>/tcp\n# firewall-cmd --permanent --zone=public --remove-port=<PORT>/tcp\n# firewall-cmd --reload\nCaveats:\nRestricting access to trusted networks or localhost prevents untrusted remote clients from reaching the service. Offloading TLS requires reconfiguring traffic routing and reverse proxy endpoints.\nWarning: Modifying firewall configurations and running `firewall-cmd --reload` will reload firewall rule sets and may cause momentary disruptions to active connections."}, "name": "CVE-2026-123864", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs20", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs22", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs24", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs25", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs26", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-11T18:17:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123864\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123864\nhttps://cna.openjsf.org/security-advisories.html\nhttps://nodejs.org/en/blog/vulnerability/november-2026-security-releases"], "statement": "This vulnerability is rated as Important rather than Moderate because an unauthenticated remote attacker can trigger heap memory corruption across concurrent sessions, potentially leaking sensitive data such as private cryptographic keys or request payloads belonging to other users. However, successful exploitation requires high attack complexity, as the target application must implement specific streaming and header-flushing behaviors during request body processing. Node.js deployments serving unencrypted HTTP or terminating TLS at an external gateway remain unaffected by this flaw.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,22.23.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0,24.22.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.0.0,26.13.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "node", "source": "cna", "vendor": "nodejs"}, "product": "nodejs", "vendor": "nodejs"}], "created": "2026-11-12T13:45:03.649065+00:00", "updated": "2026-11-12T18:30:06.848910+00:00", "vendors": ["nodejs", "nodejs$PRODUCT$nodejs"]}