The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| nodejs | node | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 23 Oct 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Node.js HTTP Agent Can Misinterpret Stale Response as New Request |
Fri, 23 Oct 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. | |
| Weaknesses | CWE-367 | |
| References |
| |
| Metrics |
cvssV3_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2026-10-23T16:15:05.837Z
Reserved: 2026-10-05T15:00:00.729Z
Link: CVE-2026-105481
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-23T17:17:19.250
Modified: 2026-10-23T19:42:24.553
Link: CVE-2026-105481
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-23T17:30:17Z
-
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition