{"id":"ALPINE-CVE-2026-123864","details":"A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","modified":"2026-11-12T19:30:03.352996558Z","published":"2026-11-11T19:17:32.790Z","upstream":["CVE-2026-123864"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2026-123864"}],"affected":[{"package":{"name":"llhttp","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/llhttp?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.4-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-123864.json"}},{"package":{"name":"nodejs","ecosystem":"Alpine:v3.21","purl":"pkg:apk/alpine/nodejs?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.5-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-123864.json"}},{"package":{"name":"nodejs","ecosystem":"Alpine:v3.22","purl":"pkg:apk/alpine/nodejs?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.5-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-123864.json"}},{"package":{"name":"nodejs","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/nodejs?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.3-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-123864.json"}},{"package":{"name":"nodejs","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/nodejs?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.3-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-123864.json"}},{"package":{"name":"nodejs-current","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/nodejs-current?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.13.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-123864.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H"}]}