CVE-2026-48931: Node.js HTTP Agent Race Condition Allows Premature Response Acceptance

Technical summary

CVE-2026-48931 is a race condition (CWE-367) in the Node.js HTTP Agent that permits premature response acceptance. The vulnerability occurs when a server sends a response before the client's HTTP request has been transmitted. The HTTP protocol strictly enforces request-response ordering; this flaw breaks that contract by allowing the Agent to validate and process responses out of sequence. The defect is present in Node.js 22, 24, and 26 across all support tiers.

Business impact

Organizations using Node.js for HTTP client operations face potential data integrity concerns. An application might process incorrect response data if a man-in-the-middle or colluding server exploits the timing window, leading to logic errors, incorrect business decisions, or state corruption. The practical impact depends on application sensitivity—financial transactions, authentication flows, or data synchronization operations carry higher risk. The low CVSS score reflects the difficult preconditions required, but applications with high request frequency or latency sensitivity may warrant closer scrutiny.

Affected systems

All active Node.js release lines are affected: Node.js 22.x, Node.js 24.x, and Node.js 26.x. If your organization runs any of these versions in production for HTTP client functionality, your environment is in scope. Inactive or EOL versions are not explicitly mentioned in the advisory but should be evaluated based on your internal support policy.

Exploitability

Exploitation requires tight coordination: a network-positioned attacker must send a crafted response and ensure it arrives before the legitimate client request is transmitted. The CVSS score of 3.7 (LOW) with AC:H (high attack complexity) and UI:N (no user interaction) reflects this constraint. While the vulnerability is real, actual exploitation in the wild remains unlikely unless an attacker controls network infrastructure or a server endpoint. The impact is integrity-focused (I:L), not confidentiality or availability.

Remediation

Apply security patches from the Node.js project for your active release line. Contact the Node.js security team or check the official Node.js website for version-specific patch releases that address this HTTP Agent flaw. Patching is the authoritative remediation; no known workarounds are documented.

Patch guidance

Verify the latest security releases for Node.js 22, 24, and 26 from nodejs.org or the official Node.js security advisory. Apply the patched version that corresponds to your deployment. If you operate a supply chain or provide Node.js distributions, audit your release pipelines to ensure patched versions are available to downstream consumers. Test patched versions in a staging environment before production rollout.

Detection guidance

Monitor HTTP client logs for unexpected responses that correlate with request timing anomalies—specifically, response events logged before their corresponding request events. Intrusion detection systems with HTTP protocol analysis may flag out-of-sequence message pairs. Code review of critical HTTP client interactions can surface architectural assumptions about request-response ordering that could be violated by this flaw.

Why prioritize this

Although rated LOW severity with high attack complexity, this vulnerability affects all three supported Node.js release lines simultaneously. Organizations should prioritize patching as part of their regular maintenance cycle rather than as an emergency, but defer to your risk tolerance if HTTP client operations handle sensitive data or run on exposed endpoints. The fixed timeline for each release line is standard; plan patching around your Node.js version support strategy.

Risk score, explained

CVSS 3.7 (LOW) reflects a narrow attack surface and difficult preconditions. The integrity impact is limited (L), and there is no confidentiality or availability loss. Attack vector is network-based but requires high complexity and precise timing. The score is appropriate for a protocol-level logic flaw that is exploitable in theory but impractical without significant attacker control.

Frequently asked questions