A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before…
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited · CVSS 6.5 Medium.
Data as of 10/25/2026, 12:14:36 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Security Response Center Microsoft | Affected
| Fixed in– |
Description
A vulnerability in Node.js HTTP Agent connection reuse can cause a client to accept a response that was sent before, potentially leading to incorrect or unexpected behavior. This flaw relates to improper handling of HTTP connection reuse in the affected version 3.0 of the product. No CVSS score or detailed impact information is provided.
Impact
The vulnerability could allow a client to accept stale or incorrect HTTP responses due to improper connection reuse handling. This may lead to application logic errors or data integrity issues. No evidence of active exploitation or further impact details are available.
Summary
CVE-2026-105481 describes a flaw in the Node.js HTTP Agent's connection reuse mechanism where a client may mistakenly accept a previously sent response as valid. This issue is identified in Microsoft-related software, specifically version 3.0. The vulnerability is categorized under CWE-367 (Time-of-check Time-of-use Race Condition). No patch or remediation details are provided in the available data.
Weaknesses
- CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.