---
id: "CVE-2026-105481"
kind: "vulnerability"
aliases: ["CVE-2026-105481"]
title: "Node.js: HTTP Agent reuse can accept a stale, unsolicited response as valid"
severity: "medium"
cvss: 6.5
epss: 0.00236
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["http-clients", "node.js", "poc-public", "runtime", "self-hosted"]
not_affected_if: ["no-outbound-http", "single-trusted-upstream"]
published_at: "2026-10-23T17:17:19+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105481", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "github-poc", "url": "https://github.com/CompleteTech-LLC/node-cve-2026-105481-check", "first_seen_at": "2026-10-23T23:55:02+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-105481", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Node.js: HTTP Agent reuse can accept a stale, unsolicited response as valid

Node.js's HTTP Agent can reuse a keep-alive socket that already holds unsolicited data, so a new request is answered with a response that was sent before the request existed. An attacker who can get bytes onto a reused connection can feed a client forged response data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `node --version` and compare against the affected lines 22.x, 24.x and 26.x
- Find services that make outbound HTTP requests with keep-alive agents (http.Agent with keepAlive, or the default agent on newer Node versions)
- unknown for whether a specific deployment is exploitable without the analyst's review of the PoC

## Fix

- Upgrade Node.js on the 22.x, 24.x and 26.x lines to the patched release listed in the Node.js security advisory (version unknown from sources)
- Until patched, avoid keep-alive connection reuse to untrusted or unreliable upstream hosts (unknown whether this fully mitigates)

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105481
- 2026-10-23T23:55:02+00:00 github-poc https://github.com/CompleteTech-LLC/node-cve-2026-105481-check
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-105481

## Documents

- [poc] CompleteTech-LLC/node-cve-2026-105481-check https://github.com/CompleteTech-LLC/node-cve-2026-105481-check

## From the sources

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.

The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_