This vulnerability in Node.js HTTP Agent is a TOCTOU race condition (CWE-367) where a client may accept a response prematurely, i.e., before the client has actually sent the request. It affects the exact versions 22.22.3, 24.16.0, and 26.3.0 of Node.js. The CVSS v3.0 base score is 3.7, indicating low severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to integrity loss. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

The vulnerability could allow an attacker to cause the client to accept an HTTP response that was sent before the client sent the request, potentially leading to integrity issues in HTTP communications. There is no impact on confidentiality or availability. The low CVSS score reflects the limited impact and complexity required to exploit this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should monitor Node.js security advisories for updates. In the meantime, consider minimizing exposure by restricting network access to trusted sources and reviewing application logic that depends on HTTP Agent behavior.