HTTP Agent Flaw in Node.js Affects Multiple Versions by Node.js Foundation

CVE-2026-48931

What is CVE-2026-48931?

A vulnerability exists in the Node.js HTTP Agent that allows a client to erroneously accept a response as valid, even when that response is sent prior to the client dispatching the request. This issue spans across all supported release lines, including Node.js versions 22, 24, and 26, potentially compromising the integrity of data exchanges and threatening application security.

References