CVE catalog

CVE-2026-105481

nodejs: CVE-2026-105481

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.28% · Oct 25, 2026

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannodejssid24.22.1+dfsg+~cs24.19.2-1fixed
Debiannodejsforky24.21.0+dfsg+~cs24.13.4-1vulnerable
Debiannodejstrixie20.19.2+dfsg-1+deb13u2vulnerable
Debiannodejstrixie-security20.19.2+dfsg-1+deb13u3vulnerable
Debiannodejsbookworm18.20.4+dfsg-1~deb12u2vulnerable
Debiannodejsbookworm-security18.20.4+dfsg-1~deb12u3vulnerable
Ubuntunodejspro12.22.5~dfsg-5ubuntu1vulnerable
Ubuntunodejspro12.22.7~dfsg-2ubuntu1vulnerable
Ubuntunodejspro12.22.7~dfsg-2ubuntu3vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu2vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.1vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.2vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.3vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.4vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.5vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.6vulnerable
Ubuntunodejspro12.22.9~dfsg-1ubuntu3.6+esm2vulnerable
Ubuntunodejs24.0418.13.0+dfsg1-1ubuntu2vulnerable
Ubuntunodejs24.0418.19.1+dfsg-2ubuntu4vulnerable
Ubuntunodejs24.0418.19.1+dfsg-6ubuntu1vulnerable
Ubuntunodejs24.0418.19.1+dfsg-6ubuntu2vulnerable
Ubuntunodejs24.0418.19.1+dfsg-6ubuntu5vulnerable
Ubuntunodejs26.1022.22.1+dfsg+~cs22.19.15-1ubuntu1vulnerable
Ubuntunodejs26.1024.16.0+dfsg+~cs24.13.1-2ubuntu1vulnerable
Ubuntunodejs26.1024.18.0+dfsg+~cs24.13.2-1ubuntu1vulnerable
Ubuntunodejs26.1024.19.0+dfsg+~cs24.13.3-1ubuntu1vulnerable
Ubuntunodejs26.0420.19.4+dfsg-1vulnerable
Ubuntunodejs26.0420.19.5+dfsg+~cs20.19.12-4vulnerable
Ubuntunodejs26.0422.21.1+dfsg+~cs22.19.0-6ubuntu4vulnerable
Ubuntunodejs26.0422.22.0+dfsg+~cs22.19.6-1ubuntu2vulnerable
Ubuntunodejs26.0422.22.0+dfsg+~cs22.19.13-2ubuntu1vulnerable
Ubuntunodejs26.0422.22.1+dfsg+~cs22.19.15-1ubuntu1vulnerable
Opensusenodejs24tumbleweed24.22.1-1.1fixed
Alpinenodejs3.2122.23.4-r0fixed
Alpinenodejs3.2222.23.4-r0fixed
Alpinenodejs3.2324.22.1-r0fixed
Alpinenodejs3.2424.22.1-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannodejssourcesid24.22.1+dfsg+~cs24.19.2-1not yet assignedNot reported[1151688]
Debiannodejssourceforky(unfixed)not yet assignedNot reported[1151688]
Debiannodejssourcetrixie(unfixed)not yet assignedNot reported[1151688]
Debiannodejssourcebookworm(unfixed)not yet assignedNot reported[1151688]
Opensusenodejs24rpmtumbleweed24.22.1-1.1Not reportedOPENSUSE-SU-2026:12248-1Not reported
Alpinenodejsapk3.2122.23.4-r0Not reportedALPINE-CVE-2026-105481Not reported
Alpinenodejsapk3.2222.23.4-r0Not reportedALPINE-CVE-2026-105481Not reported
Alpinenodejsapk3.2324.22.1-r0Not reportedALPINE-CVE-2026-105481Not reported
Alpinenodejsapk3.2424.22.1-r0Not reportedALPINE-CVE-2026-105481Not reported

[Debian bug #1151688]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libnode108]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [libnode-dev]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [nodejs]Affected
    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [nodejs-doc]Affected

    Source package: [nodejs]

    Details (4)

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Affected

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

[Debian 13 (Trixie)]

  • [libnode115]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

  • [libnode-dev]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

  • [nodejs]Affected
    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Affected

      dsa · nodejs · debian · 13

  • [nodejs-doc]Affected

    Source package: [nodejs]

    Details (5)

    • 20.19.2+dfsg-1+deb13u2 · all · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie-security

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie-security · Historical version

      Affected

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · all · trixie-security

      Affected

      dsa · nodejs · debian · 13

[openSUSE Tumbleweed]

  • [nodejs24]Affected

    Source package: [nodejs24]

    Details (1)

    • 24.18.1-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 24.22.1-1.1

      dsa · nodejs24 · opensuse · tumbleweed

  • [corepack24]Unknown

    Source package: [nodejs24]

    Details (1)

    • 24.18.1-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 24.22.1-1.1

      Version impact unknown

      dsa · nodejs24 · opensuse · tumbleweed

  • [nodejs24-devel]Unknown

    Source package: [nodejs24]

    Details (1)

    • 24.18.1-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 24.22.1-1.1

      Version impact unknown

      dsa · nodejs24 · opensuse · tumbleweed

  • [nodejs24-docs]Unknown

    Source package: [nodejs24]

    Details (1)

    • 24.18.1-1.1 · noarch · tumbleweed

      Unknown · Fixed: 24.22.1-1.1

      Version impact unknown

      dsa · nodejs24 · opensuse · tumbleweed

  • [npm24]Unknown

    Source package: [nodejs24]

    Details (1)

    • 24.18.1-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 24.22.1-1.1

      Version impact unknown

      dsa · nodejs24 · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]