CVE-2026-48931

LowCVSS 3.7/10Last modified Oct 25, 2026

Description

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
nodejs	node	>= 22.22.3, <= 22.22.3; >= 24.16.0, <= 24.16.0; >= 26.3.0, <= 26.3.0

References

https://nodejs.org/en/blog/vulnerability/june-2026-security-releasesVendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/02/2
https://github.com/nodejs/node/issues/63989Exploit, Issue Tracking, Third Party Advisory
https://jdstaerk.substack.com/p/nodejs-security-fix-silently-brokeThird Party Advisory

Timeline

Published: Jun 22, 2026
Last modified: Oct 25, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-489323.7A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from CVE-2026-489337.5A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerabi CVE-2026-489344.3A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supporte CVE-2026-489353.3A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-rea CVE-2026-489363.3A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permissio CVE-2026-489377.5A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects CVE-2026-489399.8A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulti CVE-2026-48946.9A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multi CVE-2026-489403.4A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<scr CVE-2026-489416.5The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::de CVE-2026-489426.1K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML CVE-2026-489436.5K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2