CVE-2026-105481

What it actually does

The Node.js HTTP Agent reuses keep-alive sockets without ensuring the guard that destroys idle sockets on unexpected data has run; when the event loop is busy with synchronous work an unsolicited response can already be buffered, the guard is bypassed, and the stale data is parsed as the response to a subsequent request.

Why it matters to the business

Applications built on affected Node.js versions may process incorrect or attacker-controlled responses, leading to data disclosure, logic errors, or failed operations; the incomplete fix of a prior issue and recent publication increase urgency for organizations relying on Node.js HTTP clients.

How an attack unfolds

An attacker sends an unsolicited HTTP response to a keep-alive connection; if the target Node.js process is busy and the socket is handed to a new request before the I/O-poll guard executes, the attacker-supplied data is accepted as the legitimate reply.

How to fix it

Upgrade Node.js 26.x, 24.x, and 22.x installations to the latest releases that contain the complete fix for this connection-reuse issue; disable keep-alive where feasible until patches are applied.

How to confirm the fix worked

Verify the installed Node.js version is newer than the affected ranges; exercise HTTP keep-alive workloads under load that triggers synchronous event-loop pauses and confirm unsolicited data no longer produces valid responses.

Typical attack path

1. Locate Node.js applications using the built-in HTTP/HTTPS Agent with keep-alive enabled
2. Establish or predict a keep-alive socket and inject an unsolicited response while the event loop is occupied with synchronous work
3. Trigger a new request on the same socket so the buffered data is parsed as its response
4. Observe or leverage the resulting incorrect response handling

How to detect it

Inspect application and Node.js process logs for unexpected response bodies on keep-alive connections, mismatched request/response timing, or errors during socket reuse; correlate with event-loop latency metrics.

What your security team should do

• Prioritize patching all Node.js 22.x/24.x/26.x deployments within the next maintenance window
• Review and minimize use of keep-alive sockets in internal HTTP clients
• Monitor upstream Node.js release notes for the exact fixed versions
• Add runtime checks or wrappers that reject responses arriving before a request was sent