CVE-2026-48931

Summary

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

Affected Software

Weaknesses

• CWE-367: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

ADP Enrichment

CVE Program Container

Additional References

• https://jdstaerk.substack.com/p/nodejs-security-fix-silently-broke
• https://github.com/nodejs/node/issues/63989
• http://www.openwall.com/lists/oss-security/2026/07/02/2

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

• ←Previous
• Next→