# CVE-2026-105481: Node.js HTTP Agent response confusion via keep-alive socket reuse

Source: https://junglewise.ai/threats/cve-2026-105481-a-flaw-in-node-js-http-agent-connection-reuse-can-cause-a-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-105481 · Severity: medium · CVSS 6.5 · Published 2026-10-23

Node.js is a JavaScript runtime used to build web servers and applications. A flaw in how Node.js reuses HTTP connections can cause an application to mistakenly accept a leftover response from a previous request as if it belonged to a new request, potentially exposing data intended for a different client or request. This can happen when the event loop is busy and doesn't run the cleanup code that normally prevents such confusion.

Technologies: [OpenJS Foundation Node.js](https://junglewise.ai/threats/technologies/openjs-foundation-node-js). Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-105481 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105481 being exploited in the wild.

**How severe is CVE-2026-105481?** Medium severity, with a CVSS score of 6.5, published 23 October 2026.

**Which products and versions are affected?** OpenJS Foundation Node.js 22.x, 24.x, 26.x.

**Is there a fix for CVE-2026-105481?** Yes: fixed in Node.js v22.23.4, v24.22.1, v26.12.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105481 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105481?** Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Node.js v22.23.4, v24.22.1, v26.12.1

## Technical details

The HTTP Agent in Node.js reuses keep-alive sockets for multiple requests, but a guard that clears unexpected data only runs during event loop I/O polling. If an unsolicited response has arrived on a socket but not yet been read when that socket is reused for a new request—because the event loop was busy with synchronous work—the guard is never triggered and the stale response data is parsed as the current request's response. This incomplete fix of CVE-2026-48931 is a logic error in the connection reuse mechanism that affects the HTTP/HTTPS Agent.

## Affected products

- OpenJS Foundation Node.js 22.x, 24.x, 26.x

## Timeline

- 2026-10-21: disclosed
- 2026-10-23: advisory

## References

- [https://nodejs.org/en/blog/vulnerability/october-2026-security-releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)

## Related threats

- [Node.js TLS server use-after-destroy in deferred handshake callbacks](https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server)
- [Node.js https.Agent certificate validation bypass via TLS session reuse](https://junglewise.ai/threats/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a)
- [Node.js HTTP/2 denial of service via NULL pointer dereference](https://junglewise.ai/threats/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an)
- [Node.js HTTP/2 use-after-free in respondWithFile stream reset](https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated)
- [Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a)