CVE-2026-48931

{
  "id": "CVE-2026-48931",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-22T20:16:29.957",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
    },
    {
      "lang": "es",
      "value": "Un fallo en el Agente HTTP de Node.js puede hacer que un cliente acepte como válida una respuesta que se envía antes de que el cliente haya enviado la solicitud.\n\nEsta vulnerabilidad afecta a todas las líneas de lanzamiento compatibles: Node.js 22, Node.js 24, y Node.js 26."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nodejs",
          "product": "node",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "22.22.3",
              "lessThanOrEqual": "22.22.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "24.16.0",
              "lessThanOrEqual": "24.16.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "26.3.0",
              "lessThanOrEqual": "26.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T14:14:24.449951Z",
          "id": "CVE-2026-48931",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*",
              "matchCriteriaId": "3C0C5080-5F99-4651-9855-2DE03C9070C5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*",
              "matchCriteriaId": "3B912C84-1AA5-4D74-AB1A-64162C80A33B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*",
              "matchCriteriaId": "8152ACE6-3CAF-4CA0-8B19-D4753811EB44"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/02/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/nodejs/node/issues/63989",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://jdstaerk.substack.com/p/nodejs-security-fix-silently-broke",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}