CVE-2026-48931
At a glance Severity LOW 3.7 EPSS EPSS 0.32 % · percentile 25 (2026-10-27) State PUBLISHED Published 2026-06-22 Updated 2026-07-03 Assigner hackerone NVD status Modified Description A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Scores Version Score Vector Scored by CVSS 3.0 LOW 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N hackerone CVSS 3.1 LOW 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N NVD · nvd@nist.gov (Primary) CVSS 3.0 LOW 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N NVD · support@hackerone.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*Affected products Product Versions nodejs · node affected 22.22.3 ≤ 22.22.3 ; affected 24.16.0 ≤ 24.16.0 ; affected 26.3.0 ≤ 26.3.0
References
Sources
