---
id: CVE-2026-48931
title: "A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 2…"
summary: "A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 2…"
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-367
vendor: nodejs
product: node.js
affected:
  - node.js = 22.22.3
  - node.js = 24.16.0
  - node.js = 26.3.0
published: '2026-06-22'
updated: '2026-07-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48931'
references:
  - url: 'https://nodejs.org/en/blog/vulnerability/june-2026-security-releases'
    label: support@hackerone.com
  - url: 'http://www.openwall.com/lists/oss-security/2026/07/02/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/nodejs/node/issues/63989'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://jdstaerk.substack.com/p/nodejs-security-fix-silently-broke'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48931.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-48931'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2491494'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-48931'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48931'
  - url: 'https://access.redhat.com/errata/RHSA-2026:39246'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35842'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35841'
  - url: 'https://access.redhat.com/errata/RHSA-2026:41947'
  - url: 'https://access.redhat.com/errata/RHSA-2026:39868'
  - url: 'https://access.redhat.com/errata/RHSA-2026:52399'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35892'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35891'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00323
epssPercentile: 0.25134
ingestedAt: '2026-07-03T13:02:27.816Z'
patched:
  - enterprise_linux_appstream_eus_v_10_0
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_8
  - enterprise_linux_appstream_eus_v_9_6
  - enterprise_linux_appstream_v_9
---

## Overview

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

## Affected

- `node.js = 22.22.3`
- `node.js = 24.16.0`
- `node.js = 26.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:39246** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-07-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:39246)
- **RHSA-2026:35842** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35842)
- **RHSA-2026:35841** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35841)
- **RHSA-2026:41947** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41947)
- **RHSA-2026:39868** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:39868)
- **RHSA-2026:52399** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52399)
- **RHSA-2026:35892** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35892)
- **RHSA-2026:35891** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35891)
- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48931.json)