This vulnerability in Node.js HTTP Agent (CVE-2026-48931) is a TOCTOU race condition where a client may incorrectly accept a response before sending the request. It affects supported Node.js versions 22.22.3, 24.16.0, and 26.3.0. The CVSS 3.0 base score is 3.7 (low severity) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No official fix or patch has been documented yet, and no known exploitation is reported.

The vulnerability may allow an attacker to cause a client to accept an HTTP response prematurely, potentially leading to low integrity impacts such as processing incorrect or unexpected responses. There is no impact on confidentiality or availability. The attack complexity is high, and no privileges or user interaction are required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Node.js security advisories for updates. No specific mitigations are documented at this time.