Node.js HTTP Agent Flaw Impacting Connection Validity

CVE-2026-105481

What is CVE-2026-105481?

A flaw exists in Node.js's HTTP Agent related to connection reuse, which may lead to clients incorrectly accepting unsolicited responses. This issue arises because the mechanism designed to destroy idle keep-alive sockets does not function effectively when the event loop is busy with synchronous tasks. Consequently, unsolicited data that reaches the socket before the request is processed may be misinterpreted as a valid response to subsequent requests.

References