CVE-2026-48931

published 2026-06-22

CVE-2026-48931: A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects…

Priority P4 17 low 3.7 CVSS 3.1

AV N AC H PR N UI N S U C N I L A N

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
nodejs	node	22.22.3 – 22.22.3	—
nodejs	node	24.16.0 – 24.16.0	—
nodejs	node	26.3.0 – 26.3.0	—
nodejs	node.js	—	—
nodejs	node.js	—	—
nodejs	node.js	—	—

CVSS provenance

nvd v3.1 3.7 LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

nvd v3.0 3.7 LOW CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-367