Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
52
CVE-2026-123864
Re-entrancy memory leak in Node.js HTTPS
- CVSS 3.0
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated remote client read heap memory from other connections, including TLS private keys and other users' requests. It triggers when a handler calls res.flushHeaders() before the body ends and later res.end() with a non-empty chunk, and a route echoes or stores a request body. Cleartext node:http is not affected. Node.js 26.x, 24.x, and 22.x are affected.
What to do: Apply the Node.js November 11 security release that covers CVE-2026-123864. Fixed version numbers are not stated.
| Product | Affected |
|---|---|
| Node.js | 26.x, 24.x, and 22.x |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Weakness
- CWE-416
- Vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H