Executive brief
A security flaw in the Node.js HTTP Agent could allow a client to mistakenly accept a network response before it has even sent a request. This issue, caused by a timing-related race condition, could lead to data being incorrectly associated with the wrong request. Organizations using Node.js for web services or internal applications should update to the latest patched versions to ensure data integrity.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the Node.js 'http.Agent' component. This vulnerability allows for HTTP response queue poisoning, where a client may process a response as valid even if it was received before the corresponding request was dispatched. The attack vector is network-based but requires high complexity to exploit successfully. The issue affects Node.js versions 22, 24, and 26, and has been addressed in security releases v22.23.0, v24.17.0, and v26.3.1.
Affected products
- Node.js Node.js 22.x < 22.23.0, 24.x < 24.17.0, 26.x < 26.3.1
Timeline
- 2026-06-18: patched: Security releases v22.23.0, v24.17.0, and v26.3.1 made available.
- 2026-06-22: disclosed: CVE-2026-48931 published.