Threats tagged 'ghsa-m526-rv55-w6mr'

A re-entrancy vulnerability in Node.js HTTPS allows an unauthenticated client to read memory from other connections, potentially exposing TLS private keys and other users' request data. This occurs due to a use-after-free and out-of-bounds heap read triggered by specific sequences of HTTP response handling involving res.flushHeaders() and res.end(). The flaw affects Node.js versions 22.x, 24.x, and 26.x.