Threats tagged 'bit-node-2026-105481'

A flaw in Node.js HTTP Agent connection reuse allows a client to accept a response sent before the client has sent the request. This occurs because the guard that destroys idle keep-alive sockets on unexpected data only runs when the event loop polls for I/O, and unsolicited responses may be misinterpreted as valid responses to new requests. This vulnerability affects Node.js versions 22.x, 24.x, and 26.x and is a partial regression of a previous flaw (CVE-2026-48931).