CVE-2026-105481

A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response is already buffered when the socket is assigned to a new request—for example because the event loop was busy with synchronous work—the guard is cleared without observing the data and the bytes are parsed as the response to the new request. This is an incomplete fix of CVE-2026-48931. A malicious or compromised peer that can write an early response on a reused connection may cause the client to accept unintended response content, affecting integrity and potentially confidentiality of application data.

This is a Moderate severity flaw. Red Hat rates it Moderate because successful exploitation requires a reused HTTP keep-alive connection, an unsolicited response already present on the socket, and timing such that the idle-socket guard does not observe that data before the next request (high attack complexity). When those conditions hold, the client can attribute attacker-controlled response content to a subsequent request (integrity High, confidentiality Low). Platform memory and isolation safeguards (ASLR, NX, SELinux, FORTIFY_SOURCE) do not mitigate this logic-level response mix-up and do not change the base score. The issue does not provide remote code execution by itself.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends. Where operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled). Prefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers.