ALPINE-CVE-2026-123864: Use After Free
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's onbody callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttpexecute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Node.js HTTPS servers in the affected 26.x, 24.x, and 22.x release lines are affected. Cleartext node:http servers are not affected.
What application behavior is required for exploitation?
An affected HTTPS handler must call res.flushHeaders() before the request body has finished, then call res.end() with a non-empty chunk. The attacker also needs an ordinary route that echoes or stores request-body data in order to read leaked memory.
Does an attacker need credentials or user interaction?
No. The issue can be triggered by an unauthenticated client and does not require user interaction.
What information could be exposed or what impact could occur?
A successful exploit can cause one connection's response to include freed or unrelated heap memory from other connections. This may disclose TLS private keys and other users' requests, and can also affect integrity and availability.