nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance

A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure...

nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance

A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure...

node-cve-2026-105481-check

node-cve-2026-105481-check Offline, version-only triage for CVE-2026-105481: Node.js HTTP keep-alive premature-response acceptance. node-cve-2026-105481-check compares Node.js versions that you report with the upstream fixed releases for CVE-2026-105481. The flaw is in HTTP Agent connection reuse...

nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse

A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when...

nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse

A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when...

BIT-NODE-MIN-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

BIT-NODE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

CVE-2026-105481

A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when...

Node.js 26.12.0 HTTP Keep-Alive Premature Response Acceptance

Node.js versions 22.x, 24.x, and 26.x contain an HTTP Agent keep-alive flaw that can cause a client to accept a response sent before its request. The supplied offline checker compares reported versions against fixed releases 22.23.4, 24.22.1, and 26.12.1...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3328)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3328 advisory. A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3330)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3330 advisory. A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response...

Important: nodejs22

Issue Overview: A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response association and potentially lead to HTTP response confusion or unintended data exposure...

Important: nodejs24

Issue Overview: A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response association and potentially lead to HTTP response confusion or unintended data exposure...

Node.js HTTP Keep-Alive Premature-Response Acceptance

Node.js versions prior to 22.23.4, 24.22.1, and 26.12.1 contain an HTTP Agent connection-reuse flaw that can accept a response sent before the corresponding request...

ALPINE-CVE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

CVE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

AZL-111056 CVE-2026-105481 affecting package nodejs for versions less than 24.22.1-0

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

DEBIAN-CVE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

UBUNTU-CVE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

CVE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...