Nodejs: A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. (CVE-2026-48931)
Description
A vulnerability in the Node.js HTTP Agent allows a client to accept a response as valid even if it is received before the client has sent the corresponding request. This issue affects multiple supported Node.js release lines prior to 22.23.0, from 23.0.0 up to but not including 24.17.0, and from 25.0.0 up to but not including 26.3.1. The severity is assessed as medium with a CVSS score of 3.7. A patch is available to address this flaw.
CVSS v3.0
Score 3.7low
Affected software
pkg:bitnami/nodepkg:deb/ubuntu/nodejs?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/nodejs?arch=source&distro=noblepkg:deb/ubuntu/nodejs?arch=source&distro=questingpkg:deb/ubuntu/nodejs?arch=source&distro=stonkingpkg:deb/ubuntu/nodejs?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48931 describes a flaw in the Node.js HTTP Agent where a client can incorrectly accept a response as valid even if it arrives before the client has sent the associated request. This affects Node.js versions prior to 22.23.0, versions from 23.0.0 up to but excluding 24.17.0, and versions from 25.0.0 up to but excluding 26.3.1. The vulnerability has a CVSS 3.0 base score of 3.7, indicating a low to medium severity impact primarily on integrity. No known exploits are reported in the wild. A patch is available to fix this issue.
Potential Impact
The vulnerability could allow a client to accept an HTTP response prematurely, potentially leading to integrity issues in HTTP communications. However, the CVSS score and severity indicate the impact is limited and does not affect confidentiality or availability. No active exploitation is known.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Node.js to versions 22.23.0 or later, 24.17.0 or later, and 26.3.1 or later, depending on their current version line. Applying these updates will remediate the issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-node-2026-48931
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-48931"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Low
- State
- PUBLISHED
Threat ID: 6aa005faacd9273b49ab6877
Added to database: 09/08/2026, 12:56:26 UTC
Last enriched: 10/18/2026, 05:33:17 UTC
Last updated: 10/23/2026, 15:10:13 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.