UBUNTU-CVE-2026-123864: Use After Free
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's onbody callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttpexecute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only HTTPS servers using affected Node.js 22.x, 24.x, or 26.x are described as affected. Cleartext node:http is not affected.
What application behavior is required for exploitation?
A request handler must call res.flushHeaders() before the request body has ended and later call res.end() with a non-empty chunk. An unauthenticated client can then trigger the condition by interacting with that handler.
What is needed to observe leaked data?
The application must also have an ordinary route that echoes or stores a request body. The flaw can cause freed or unrelated heap memory to be copied into a response body, potentially exposing data from other connections such as TLS private keys or other users' requests.