Is CVE-2026-123864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123864 being exploited in the wild.

How severe is CVE-2026-123864?

High severity, with a CVSS score of 8.1, published 11 November 2026.

Which products and versions are affected?

OpenJS Foundation Node.js 22.x, 24.x, 26.x.

Is there a fix for CVE-2026-123864?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-123864 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123864?

Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123864: Node.js HTTPS memory disclosure via TLS write re-entrancy

CVE-2026-123864 · Severity: high · CVSS 8.1 · Published 2026-11-11

Node.js HTTPS servers can be exploited by unauthenticated attackers to leak sensitive server memory, including TLS private keys and other users' request data. An attacker triggers a re-entrancy flaw in the HTTPS parser by sending specific request patterns, causing the server to copy freed or unrelated heap memory into the response. This exposes cryptographic keys and confidential information from other connections running on the same server.

Technologies: OpenJS Foundation Node.js. Vendors: OpenJS Foundation.

Quick answers

Is CVE-2026-123864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123864 being exploited in the wild.
How severe is CVE-2026-123864?: High severity, with a CVSS score of 8.1, published 11 November 2026.
Which products and versions are affected?: OpenJS Foundation Node.js 22.x, 24.x, 26.x.
Is there a fix for CVE-2026-123864?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-123864 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123864?: Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A re-entrancy vulnerability in TLSWrap::DoWrite() allows a zero-length write to call ClearOut() while the llhttp parser is mid-execution, causing the parser to re-enter and trigger a use-after-free and out-of-bounds heap read. An unauthenticated remote attacker can exploit this by crafting requests to handlers that call res.flushHeaders() before the body ends and res.end() with a non-empty chunk. The leaked memory can then be read from any endpoint that echoes or stores request bodies. Cleartext HTTP is not affected.

Affected products

OpenJS Foundation Node.js 22.x, 24.x, 26.x

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.