CVE-2026-105481 nodejs CVE debrief

Who should care

Node.js users and administrators of 26.x, 24.x, and 22.x deployments should assess exposure and verify fixes. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-105481 allows clients to accept unsolicited responses as valid due to a flaw in Node.js HTTP Agent connection reuse. Node.js 26.x, 24.x, and 22.x users should assess exposure and verify fixes.

• Verify potential unsolicited responses in Node.js deployments
• Assess exposure of affected Node.js versions
• Monitor for potential security consequences

Technical summary

The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This can cause a client to accept as valid a response that was sent before the client has sent the request.

Defensive priority

Node.js 26.x, 24.x, and 22.x users should assess exposure and verify fixes.

Recommended defensive actions

• Assess exposure of Node.js 26.x, 24.x, and 22.x deployments
• Verify fixes or workarounds with Node.js maintainers
• Monitor for potential unsolicited responses
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. A source reference from Node.js offers additional context. The Node.js source reference provides additional information about the vulnerability and its impact. The CVE Program record and NVD entry provide official details on the vulnerability. The official advisory from Node.js provides additional context and guidance on mitigating the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.