Live › vulnerability › CVE-2026-105481
Go to dashboardNode.js's HTTP Agent can reuse a keep-alive socket that already holds unsolicited data, so a new request is answered with a response that was sent before the request existed. An attacker who can get bytes onto a reused connection can feed a client forged response data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any application running Node.js 22.x, 24.x or 26.x that makes outbound HTTP requests with connection reuse can be affected. The risk is highest where the client talks to servers or intermediaries that an attacker can influence, since the attacker needs to get unsolicited data onto a socket that is later reused. Services that only serve inbound traffic or make no outbound HTTP calls can likely skip it.
No product ranges from the sources yet.
node --version and compare against the affected lines 22.x, 24.x and 26.xEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
This page as .md · .json · in your agent: get_signal("CVE-2026-105481")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.