Re-entrancy Flaw in Node.js HTTPS Allows Memory Disclosure
CVE-2026-123864

8.1HIGH

Key Information:

Vendor

Nodejs

Status
Node
Vendor
CVE Published:
11 November 2026

What is CVE-2026-123864?

A re-entrancy flaw in Node.js HTTPS allows an unauthenticated client to read sensitive memory, risking exposure of TLS private keys and requests from other users. This vulnerability arises when the TLSWrap::DoWrite() function is improperly invoked during an active request, leading to potential use-after-free and out-of-bounds memory access. Exploitation requires specific request handling sequences, making it essential for developers using affected Node.js versions to assess and mitigate this risk.

Affected Version(s)

node 0.0.0 < 22.23.5

node 23.0.0 < 24.22.3

node 25.0.0 < 26.13.1

References

https://nodejs.org/en/blog/vulnerability/november-2026-se...
vendor-advisory
https://cna.openjsf.org/security-advisories.html

CVSS V3.0

Score:
8.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chris Rohlf in collaboration with Claude and Anthropic Research
mcollina
ShogunPanda
pimterry
aduh95
.