CVE-2026-123864

A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite calls ClearOut directly when asked to write zero bytes; if that write is issued from JavaScript running inside the...