CVE-2026-48931
published 2026-06-22CVE-2026-48931: A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects…
PriorityP416low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.34%
27.0th percentile
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | node | 22.22.3 – 22.22.3 | — |
| nodejs | node | 24.16.0 – 24.16.0 | — |
| nodejs | node | 26.3.0 – 26.3.0 | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs_26 | nodejs | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv3.03.7LOWCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
ghsa_unreviewed·2026-06-22
CVE-2026-48931 [LOW] CWE-367 A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Red Hat
nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance
vendor_redhat·2026-06-22·CVSS 3.7
CVE-2026-48931 [LOW] CWE-367 nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance
nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure.
Statement: This is a Low impact flaw in the Node.js HTTP Agent where a client may prematurely accept and process an HTTP response before its corresponding request has been fully sent. This could lead to a client misinterpreting data or
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-48931 nodejs22: Node.js HTTP Agent: Information disclosure due to premature response acceptance [fedora-all]
bugzilla·2026-08-13·CVSS 3.7
CVE-2026-48931 [LOW] CVE-2026-48931 nodejs22: Node.js HTTP Agent: Information disclosure due to premature response acceptance [fedora-all]
CVE-2026-48931 nodejs22: Node.js HTTP Agent: Information disclosure due to premature response acceptance [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Bugzilla
CVE-2026-48931 nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance
bugzilla·2026-06-22·CVSS 3.7
CVE-2026-48931 [LOW] CVE-2026-48931 nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance
CVE-2026-48931 nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
2026-06-22
Published