CVE-2026-105481
published 2026-10-23CVE-2026-105481: A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an…
PriorityP339medium6.5CVSS 3.0
AVNACHPRNUINSUCLIHAN
EPSS
0.31%
23.2th percentile
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | node | 22.23.3 – 22.23.3 | — |
| nodejs | node | 24.22.0 – 24.22.0 | — |
| nodejs | node | 26.12.0 – 26.12.0 | — |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request.
ghsa_unreviewed·2026-10-23·CVSS 3.7
CVE-2026-105481 [LOW] CWE-367 A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
VulDB
Node.js up to 22.23.3/24.22.0/26.12.0 HTTP Agent improper synchronization
vuldb·2026-10-23·CVSS 6.5
CVE-2026-105481 [MEDIUM] Node.js up to 22.23.3/24.22.0/26.12.0 HTTP Agent improper synchronization
A vulnerability classified as critical was found in Node.js up to 22.23.3/24.22.0/26.12.0. The affected element is an unknown function of the component HTTP Agent. Executing a manipulation can lead to improper synchronization.
This vulnerability is tracked as CVE-2026-105481. The attack can be launched remotely. No exploit exists.
Red Hat
nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse
vendor_redhat·2026-10-23·CVSS 6.5
CVE-2026-105481 [MEDIUM] CWE-367 nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse
nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw was found in Node.js. Th
Fortinet
Multiple Node.js CVEs
vendor_fortinet·CVSS 6.5
CVE-2026-105482 [MEDIUM] Multiple Node.js CVEs
FG-IR-26-187: Multiple Node.js CVEs
CVSSv3 Score:
9.8
CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 -
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-105481 nodejs24: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-44]
bugzilla·2026-10-26·CVSS 6.5
CVE-2026-105481 [MEDIUM] CVE-2026-105481 nodejs24: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-44]
CVE-2026-105481 nodejs24: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for exampl
Bugzilla
CVE-2026-105481 nodejs24: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-rawhide]
bugzilla·2026-10-26·CVSS 6.5
CVE-2026-105481 [MEDIUM] CVE-2026-105481 nodejs24: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-rawhide]
CVE-2026-105481 nodejs24: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for e
Bugzilla
CVE-2026-105481 nodejs22: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-rawhide]
bugzilla·2026-10-26·CVSS 6.5
CVE-2026-105481 [MEDIUM] CVE-2026-105481 nodejs22: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-rawhide]
CVE-2026-105481 nodejs22: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for e
Bugzilla
CVE-2026-105481 nodejs22: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-44]
bugzilla·2026-10-26·CVSS 6.5
CVE-2026-105481 [MEDIUM] CVE-2026-105481 nodejs22: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-44]
CVE-2026-105481 nodejs22: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for exampl
Bugzilla
CVE-2026-105481 nodejs22: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-43]
bugzilla·2026-10-26·CVSS 6.5
CVE-2026-105481 [MEDIUM] CVE-2026-105481 nodejs22: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-43]
CVE-2026-105481 nodejs22: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for exampl
Bugzilla
CVE-2026-105481 nodejs24: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-43]
bugzilla·2026-10-26·CVSS 6.5
CVE-2026-105481 [MEDIUM] CVE-2026-105481 nodejs24: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-43]
CVE-2026-105481 nodejs24: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for exampl
Bugzilla
CVE-2026-105481 nodejs26: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-rawhide]
bugzilla·2026-10-26·CVSS 6.5
CVE-2026-105481 [MEDIUM] CVE-2026-105481 nodejs26: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-rawhide]
CVE-2026-105481 nodejs26: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for e
Bugzilla
CVE-2026-105481 nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse
bugzilla·2026-10-23·CVSS 6.5
CVE-2026-105481 [MEDIUM] CVE-2026-105481 nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse
CVE-2026-105481 nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
2026-10-23
Published