← All advisories

Low severity3.7NVD Advisory· Published Jun 22, 2026· Updated Jul 3, 2026

CVE-2026-48931

CVE-2026-48931

Description

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

Affected products

11

osv-coords6 versions
pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweed pkg:bitnami/node-min pkg:rpm/opensuse/nodejs26&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0 pkg:bitnami/node
< 24.17.0-1.1+ 5 more
- (no CPE)range: < 24.17.0-1.1
- (no CPE)range: < 22.23.0
- (no CPE)range: < 26.3.1-1.1
- (no CPE)range: < 24.18.0-160000.1.1
- (no CPE)range: < 22.23.0-160000.1.1
- (no CPE)range: < 22.23.0
Node.js/Node.js4 versions
cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*+ 3 more
- cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*
- cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*
- cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*
- (no CPE)
Node.js/node:fsllm-fuzzy

Patches

Vulnerability mechanics

References

4

github.com/nodejs/node/issues/63989nvdExploitIssue TrackingThird Party Advisory
jdstaerk.substack.com/p/nodejs-security-fix-silently-brokenvdThird Party Advisory
nodejs.org/en/blog/vulnerability/june-2026-security-releasesnvdVendor Advisory
www.openwall.com/lists/oss-security/2026/07/02/2nvd

News mentions

1

Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication Bypasses
Cyber Security News · Jun 19, 2026