CVE-2026-105481
Description
A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response is already buffered when the socket is assigned to a new request—for example because the event loop was busy with synchronous work—the guard is cleared without observing the data and the bytes are parsed as the response to the new request. This is an incomplete fix of CVE-2026-48931. A malicious or compromised peer that can write an early response on a reused connection may cause the client to accept unintended response content, affecting integrity and potentially confidentiality of application data.
Statement
This is a Moderate severity flaw. Red Hat rates it Moderate because successful exploitation requires a reused HTTP keep-alive connection, an unsolicited response already present on the socket, and timing such that the idle-socket guard does not observe that data before the next request (high attack complexity). When those conditions hold, the client can attribute attacker-controlled response content to a subsequent request (integrity High, confidentiality Low). Platform memory and isolation safeguards (ASLR, NX, SELinux, FORTIFY_SOURCE) do not mitigate this logic-level response mix-up and do not change the base score. The issue does not provide remote code execution by itself.
Mitigation
Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.
Where operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).
Prefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
cve.org: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Red Hat CVSS v3 Score Explanation
Aligned with CNA. AC:H — keep-alive reuse plus race where unsolicited response is buffered before idle-socket I/O guard runs (incomplete fix of CVE-2026-48931). C:L/I:H — client may accept attacker-controlled response as authoritative for a later request. ASLR/NX/SELinux/FORTIFY do not mitigate this logic flaw.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
