CVE-2026-123864

Node.js is vulnerable to a cross-connection memory disclosure via a re-entrancy flaw in the HTTPS request parser. The issue occurs because TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if this occurs within the HTTP parser's on_body callback, it decrypts the next TL...