Node.js has patched a memory disclosure bug in its HTTPS stack that lets an unauthenticated client read another connection's memory, including TLS private keys. The fix shipped on 11 November 2026 in CVE-2026-123864, alongside a set of HTTP/2 teardown flaws in the same release.

What happened

TLSWrap::DoWrite() calls ClearOut() directly when a JavaScript caller asks it to write zero bytes. If that write happens inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-enters llhttp_execute(), and triggers a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response body for the request.

The CVE record scores it CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H). Reaching it takes a handler that calls res.flushHeaders() before the request body ends and later ends the response with a non-empty chunk, and reading the leaked memory takes any ordinary route that echoes or stores a request body. Cleartext node:http is not affected.

The same release fixes HTTP/2 teardown issues, including CVE-2026-123863, where an unauthenticated client can abort the whole process on a default HTTP/2 server whose handler responds before the request body has ended.

Who is affected

• Node.js 22.x before 22.23.5, 24.x before 24.22.3 and 26.x before 26.13.1, across one or both issues.
• Express, Fastify and NestJS services that stream a response before the request body completes.
• APIs that echo or store uploaded bodies: webhooks, file ingest endpoints, upload handlers.
• End-of-life release lines, which the project states are always affected when a security release lands.

What to do now

Move to Node.js 22.23.5, 24.22.3 or 26.13.1, and rebuild the container image rather than swapping the runtime on a single host.

• Find the runtime version in every container image, CI base image and serverless layer, not only on long-lived servers.
• Rotate the TLS private keys of any Node HTTPS service that has been internet-facing, because a heap leak of key material cannot be ruled out from logs alone.
• Watch response bodies for unexpected key material or fragments of other requests, and alert on process exits with the HTTP/2 assertion failure.
• Put a dated migration plan on the end-of-life lines instead of patching them indefinitely.

What this means for South African businesses

Node.js is the default runtime for the small custom portals and client-facing apps that local agencies and MSPs build, and those apps are usually the least inventoried software on the estate. The realistic exposure for an SME is not a nation-state attack, it is a cheap API endpoint built three years ago with no owner and no dependency process. Rotating a TLS key sounds drastic until you consider what a leaked private key does to a client portal that relies on it for trust.

Source: Node.js 11 November 2026 security releases.

Also on the blog

• Apache HTTP Server CVE-2026-119618: CVSS 9.8 mod_http2 RCE, fixed in 2.4.71
• Stats SA job-seeker data sells for R34,000 as SA breach reports pass 8,000

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.