CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent`
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0Fixed in 24.17.0Fixed in 26.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.17.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-48931?
CVE-2026-48931 has a low severity rating of 3.7.
How do I fix CVE-2026-48931?
To mitigate CVE-2026-48931, ensure that you are using an updated version of Node.js that addresses this vulnerability.
What types of systems are affected by CVE-2026-48931?
CVE-2026-48931 affects all supported release lines of Node.js: 22, 24, and 26.
What is the risk associated with CVE-2026-48931?
The risk associated with CVE-2026-48931 is considered low, but it can lead to validation issues with responses from the HTTP Agent.
When was CVE-2026-48931 published?
CVE-2026-48931 was published on June 22, 2026.