DEBIAN-CVE-2026-123864: Use After Free
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's onbody callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttpexecute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Only HTTPS Node.js servers in the affected 22.x, 24.x, and 26.x lines are exposed. Cleartext node:http deployments are not affected.
What application behavior is required for exploitation?
A request handler must call res.flushHeaders() before the request body has finished and later call res.end() with a non-empty chunk. An attacker also needs access to an ordinary route that echoes or stores request-body data in order to read leaked memory.
Does exploitation require authentication or user interaction?
No. An unauthenticated client can trigger the flaw, and no user interaction is required.
What could be exposed if exploitation succeeds?
The server may include freed or unrelated heap memory in a response body. This can expose memory from other connections, including TLS private keys and other users' requests.