SecuriTricks - CVE-2026-48931

Description

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Product(s) Impacted

Vendor	Product	Versions
Nodejs	Node.js	22, 24, 26

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	nodejs	node.js	22	/	/	/	/	/	/	/
a	nodejs	node.js	24	/	/	/	/	/	/	/
a	nodejs	node.js	26	/	/	/	/	/	/	/

References

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

https://github.com/nodejs/node/issues/63989

https://jdstaerk.substack.com/p/nodejs-security-fix-silently-broke

CVSS Score

3.7 / 10

CVSS Data - 3.0

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: LOW
Availability Impact: NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

View Vector String

Timeline

Published: June 22, 2026, 8:16 p.m.
Last Modified: June 22, 2026, 11:16 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

[email protected]

CVE-2026-48931