CVE-2026-48931: Node.js HTTP Agent CSRF Vulnerability

CVE-2026-48931 Overview

CVE-2026-48931 is a flaw in the Node.js HTTP Agent that allows a client to accept an HTTP response as valid before it has sent the corresponding request. The defect is classified under [CWE-367] Time-of-Check Time-of-Use (TOCTOU) and affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. An attacker positioned to send unsolicited data on a reused connection can influence what the client treats as a legitimate response. The issue carries a CVSS 3.0 base score of 3.7 with a network attack vector and high attack complexity. No exploitation in the wild has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact

A malicious server or on-path attacker can cause a Node.js HTTP client to consume a pre-staged response as if it answered the next outbound request, leading to limited integrity loss in HTTP-based workflows.

Affected Products

• Node.js 22 (all supported releases prior to the June 2026 security update)
• Node.js 24 (all supported releases prior to the June 2026 security update)
• Node.js 26 (all supported releases prior to the June 2026 security update)

Discovery Timeline

• 2026-06-22 - CVE-2026-48931 published to NVD
• 2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-48931

Vulnerability Analysis

The Node.js HTTP Agent manages a pool of keep-alive sockets for outbound HTTP requests. The vulnerability stems from a race condition in how the Agent associates inbound bytes with outbound requests on a reused socket. A response that arrives or was already buffered before the client dispatches a request can be accepted as the answer to that request. This breaks the request-response pairing assumption that HTTP/1.1 pipelining and keep-alive reuse rely on. The attacker does not need credentials or user interaction, but exploitation requires precise control over connection state, which raises attack complexity.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) condition between the moment the Agent checks socket readiness and the moment it writes the request and reads the response. Data that should not yet exist on the socket is consumed as the response body and headers. The check that a socket is idle and ready does not atomically guarantee that no server-originated bytes are pending.

Attack Vector

Exploitation requires the attacker to control a server the Node.js client connects to, or to occupy an on-path position on a reused HTTP connection. The attacker pre-stages a crafted HTTP response on the socket. When the client subsequently issues a request through the HTTP Agent, the Agent matches the queued bytes to that request. The attacker can then influence application logic that depends on response headers, status codes, or body content. See the Node.js June 2026 Security Blog, GitHub Node.js Issue #63989, and the Substack Node.js Security Analysis for detailed technical context.

Detection Methods for CVE-2026-48931

Indicators of Compromise

• HTTP response bytes received on a keep-alive socket before the corresponding request was written by the Node.js process.
• Application logs showing response status codes, headers, or bodies that do not match the request URL or method recorded immediately before.
• Unexpected reuse of upstream connections to attacker-controlled or untrusted HTTP endpoints.

Detection Strategies

• Instrument outbound HTTP clients to log a correlation identifier on each request and assert it against response headers echoed by trusted upstreams.
• Inspect network telemetry for server-initiated data on idle HTTP/1.1 sockets that were established by Node.js processes.
• Audit dependencies that use the default http.Agent or https.Agent with keepAlive: true against the patched Node.js versions.

Monitoring Recommendations

• Track Node.js runtime versions across the fleet and alert on any host running an unpatched 22, 24, or 26 release line.
• Monitor egress connections from Node.js workloads to untrusted destinations and flag long-lived keep-alive sessions.
• Capture and review process-level network metadata to detect anomalous response timing relative to request emission.

How to Mitigate CVE-2026-48931

Immediate Actions Required

• Upgrade Node.js to the patched release in the 22, 24, or 26 line published in the Node.js June 2026 Security Blog.
• Rebuild and redeploy container images and serverless bundles that pin a vulnerable Node.js base image.
• Inventory production services that perform outbound HTTP calls through the built-in http or https modules and prioritize them for patching.

Patch Information

The Node.js project released fixed versions across the 22, 24, and 26 lines in the June 2026 security releases. The patch corrects the HTTP Agent so that buffered or server-originated bytes received before a request is dispatched are not consumed as the response to that request. Refer to the Node.js June 2026 Security Blog for the exact patched version numbers and to GitHub Node.js Issue #63989 for the upstream tracking discussion.

Workarounds

• Disable HTTP keep-alive on sensitive outbound clients by setting keepAlive: false on the http.Agent or https.Agent until the runtime is patched.
• Restrict outbound HTTP traffic from Node.js workloads to vetted destinations via egress proxies or allowlists.
• Validate response content against expected schemas and reject responses whose headers or status do not match the requested resource.

# Configuration example: disable keep-alive as a temporary mitigation
node -e "const http = require('http'); const agent = new http.Agent({ keepAlive: false }); http.globalAgent = agent;"