{"id":"CVE-2026-105481","kind":"vulnerability","aliases":["CVE-2026-105481"],"related":[],"title":"Node.js: HTTP Agent reuse can accept a stale, unsolicited response as valid","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","summary":"Node.js's HTTP Agent can reuse a keep-alive socket that already holds unsolicited data, so a new request is answered with a response that was sent before the request existed. An attacker who can get bytes onto a reused connection can feed a client forged response data.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-clients","node.js","poc-public","runtime","self-hosted"],"not_affected_if":["no-outbound-http","single-trusted-upstream"],"how_to_check":"- `node --version` and compare against the affected lines 22.x, 24.x and 26.x\n- Find services that make outbound HTTP requests with keep-alive agents (http.Agent with keepAlive, or the default agent on newer Node versions)\n- unknown for whether a specific deployment is exploitable without the analyst's review of the PoC","fix":"- Upgrade Node.js on the 22.x, 24.x and 26.x lines to the patched release listed in the Node.js security advisory (version unknown from sources)\n- Until patched, avoid keep-alive connection reuse to untrusted or unreliable upstream hosts (unknown whether this fully mitigates)","status":"open","published_at":"2026-10-23T17:17:19+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:47:13+00:00","updated_at":"2026-10-25T03:47:13+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:47:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js on the 22.x, 24.x and 26.x lines to the patched release listed in the Node.js security advisory (version unknown from sources)\n- Until patched, avoid keep-alive connection reuse to untrusted or unreliable upstream hosts (unknown whether this fully mitigates)","reach":"network","title":"Node.js: HTTP Agent reuse can accept a stale, unsolicited response as valid","impact":"medium","summary":"Node.js's HTTP Agent can reuse a keep-alive socket that already holds unsolicited data, so a new request is answered with a response that was sent before the request existed. An attacker who can get bytes onto a reused connection can feed a client forged response data.","category":"runtime","nicknames":[],"who_cares":["node.js","self-hosted","http-clients"],"confidence":0.6,"needs_auth":"unknown","worst_case":"client accepts forged response data meant for another request","analyst_note":"Confirm the patched Node.js versions from the Node.js security release and check the PoC repo at github.com/CompleteTech-LLC/node-cve-2026-105481-check for exploit conditions.","how_to_check":"- `node --version` and compare against the affected lines 22.x, 24.x and 26.x\n- Find services that make outbound HTTP requests with keep-alive agents (http.Agent with keepAlive, or the default agent on newer Node versions)\n- unknown for whether a specific deployment is exploitable without the analyst's review of the PoC","needs_analyst":true,"not_affected_if":["no-outbound-http","single-trusted-upstream"],"who_is_affected":"Any application running Node.js 22.x, 24.x or 26.x that makes outbound HTTP requests with connection reuse can be affected. The risk is highest where the client talks to servers or intermediaries that an attacker can influence, since the attacker needs to get unsolicited data onto a socket that is later reused. Services that only serve inbound traffic or make no outbound HTTP calls can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":3502,"output_tokens":733,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105481':15A,18A '-2026':14A,17A,114C '-48931':115C '22':201C '24':198C '26':196C 'accept':6A,92C 'affect':194C 'agent':3A,33B,84C 'aliv':39B,123C 'alreadi':42B,143C 'answer':51B 'arriv':128C 'attack':63B 'busi':169C 'byte':67B 'caus':88C 'client':21B,75B,90C,102C 'connect':71B,85C 'cve':13A,16A,113C 'data':45B,78B,127C,182C 'destroy':119C 'event':133C,166C 'exampl':163C 'exist':61B 'feed':73B 'fix':111C 'flaw':80C 'forg':76B 'get':66B 'guard':117C,174C 'hand':157C 'hold':43B 'host':29B 'http':2A,20B,32B,83C 'http-client':19B 'i/o':137C 'idl':120C 'incomplet':110C 'keep':38B,122C 'keep-al':37B,121C 'loop':134C,167C 'new':48B,160C,190C 'node.js':1A,22B,30B,82C,195C 'onto':68B 'pars':184C 'poc':24B 'poc-publ':23B 'poll':135C 'public':25B 'reach':144C 'read':151C 'remov':176C 'request':49B,60B,106C,161C,191C 'respons':10A,54B,77B,96C,141C,187C 'reus':4A,35B,70B,86C 'run':130C 'runtim':26B 'see':178C 'self':28B 'self-host':27B 'sent':57B,99C,104C 'socket':40B,124C,146C,155C 'stale':8A 'synchron':171C 'unexpect':126C 'unsolicit':9A,44B,140C 'valid':12A,94C 'vulner':193C 'without':177C 'work':172C 'x':197C,199C,202C 'yet':152C","nicknames":[],"mitigations":[],"who_affected":"Any application running Node.js 22.x, 24.x or 26.x that makes outbound HTTP requests with connection reuse can be affected. The risk is highest where the client talks to servers or intermediaries that an attacker can influence, since the attacker needs to get unsolicited data onto a socket that is later reused. Services that only serve inbound traffic or make no outbound HTTP calls can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T17:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","cvss_by":"support@hackerone.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-105481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105481","severity":null,"published_at":"2026-10-23T17:17:19+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"github-poc","external_id":"CompleteTech-LLC/node-cve-2026-105481-check","url":"https://github.com/CompleteTech-LLC/node-cve-2026-105481-check","severity":null,"published_at":"2026-10-23T23:47:39+00:00","modified_at":null,"first_seen_at":"2026-10-23T23:55:02+00:00","fetched_at":"2026-10-23T23:55:02+00:00","note":null}],"documents":[{"id":2244,"url":"https://github.com/CompleteTech-LLC/node-cve-2026-105481-check","title":"CompleteTech-LLC/node-cve-2026-105481-check","kind":"poc","source":"github","text":"Standalone defensive checker project for CVE-2026-105481: Node.js: HTTP keep-alive premature-response acceptance. One exploit per repository; implementation pending.\n\nstars 0","published_at":"2026-10-23T23:47:39+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}