CVE-2026-105481: nodejs node (Medium, CVSS 6.5)
- CVSS
- 6.5 Medium (v3.0)
- EPSS
- 0.3% chance of exploitation in the next 30 days (higher than 24.8% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 1 GitHub repository
- Weakness
- CWE-367
- Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N- Published
- Oct 23, 2026
What it is
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Description from the National Vulnerability Database.
What to do
Check whether you run nodejs node, then apply the vendor’s fix or mitigation from the advisories below. Because this flaw is exploited or has public exploit code, treat it as urgent and check for signs of compromise, not just the patch level.
ThreatRoundup coverage
Node.js Patches a Brotli Bug That Squeezes Past Its Own Buffer
Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.