Описание
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response is already buffered when the socket is assigned to a new request—for example because the event loop was busy with synchronous work—the guard is cleared without observing the data and the bytes are parsed as the response to the new request. This is an incomplete fix of CVE-2026-48931. A malicious or compromised peer that can write an early response on a reused connection may cause the client to accept unintended response content, affecting integrity and potentially confidentiality of application data.
Отчет
This is a Moderate severity flaw. Red Hat rates it Moderate because successful exploitation requires a reused HTTP keep-alive connection, an unsolicited response already present on the socket, and timing such that the idle-socket guard does not observe that data before the next request (high attack complexity). When those conditions hold, the client can attribute attacker-controlled response content to a subsequent request (integrity High, confidentiality Low). Platform memory and isolation safeguards (ASLR, NX, SELinux, FORTIFY_SOURCE) do not mitigate this logic-level response mix-up and do not change the base score. The issue does not provide remote code execution by itself.
Меры по смягчению последствий
Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends. Where operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled). Prefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | nodejs22 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | nodejs24 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | nodejs26 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | nodejs:22/nodejs | Fix deferred | ||
| Red Hat Enterprise Linux 9 | nodejs:22/nodejs | Fix deferred | ||
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | Fix deferred | ||
| Red Hat Hardened Images | hi/nodejs | Not affected | ||
| Red Hat Hardened Images | nodejs20 | Not affected | ||
| Red Hat Hardened Images | nodejs22 | Not affected | ||
| Red Hat Hardened Images | nodejs24 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
A flaw in Node.js HTTP Agent connection reuse can cause a client to ac ...
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
EPSS
6.5 Medium
CVSS3