Prioritizing Node.js CVE-2026-105481 Across a Mixed Fleet
CVE-2026-105481 is rated Medium, but a single environmental fact can raise its importance: a Node.js client that reuses sockets for privileged calls to untrusted or shared services. Fleet prioritization should separate the runtime version from the concrete trust path instead of treating every Node.js installation alike.
Vulnerability overview
Node.js disclosed the issue on October 21, 2026 and fixed it in 22.23.4, 24.22.1 and 26.12.1. The affected release lines are 22.x, 24.x and 26.x. The flaw is a response-ordering race in HTTP Agent keep-alive reuse.
GitHub Advisory GHSA-7h83-3rfm-3p3v records CVSS 3.1 score 6.5 and CWE-367. The issue is an incomplete fix for CVE-2026-48931. Node.js describes it as Medium severity, while the business priority depends on which responses the affected client trusts.
Mechanism and exploitation conditions
An HTTP/1.1 keep-alive socket should contain a clean response boundary before reuse. Node.js checks for unexpected data and can destroy an idle socket, but the check is tied to event-loop I/O polling. Synchronous work can delay it long enough for a socket with buffered response bytes to be assigned to a later request.
The client may then parse the earlier bytes as the response to the new request. The attacker needs control or influence over a peer and enough timing precision to make the race happen. The published vector uses network attack with high complexity and no privileges or user interaction.
Impact
The security consequence is a wrong response being treated as current and authoritative. The client may accept stale data, apply the wrong status or expose a response body to the wrong application context. The CVSS vector assigns low confidentiality impact, high integrity impact and no availability impact.
Prioritize workflows where the response controls an identity, authorization decision, resource address, financial state or administrative action. A client that downloads public documentation and validates a simple checksum has less consequential exposure than a control plane that uses the response to choose the next privileged operation.
The available CVE enrichment lists no active exploitation and no automatable status. The absence of mass exploitation should guide communication, not remove the patch requirement. A compromised dependency or upstream service can provide the hostile response source.
Affected products and scope
Affected applications use Node.js 22.23.3 or earlier, 24.22.0 or earlier, or 26.12.0 or earlier. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. Include embedded runtimes in build tools, management agents and packaged products.
Distinguish clients that disable keep-alive or create fresh agents from clients that pool connections across tenants and credential scopes. The vulnerable code path is most relevant when an Agent reuses a socket and the destination can influence response timing. That context makes a small privileged client population more important than a large read-only one.
Exposure context
The ZoomEye Search app="Node.js" returned 5,546,265 matches. The separate CVE Filter vul.cve="CVE-2026-105481" returned 0. Exposure is 5,546,265 under the maximum-selected-count rule.
This is a product-fingerprint number, not a confirmed vulnerable-device count. It cannot reveal runtime versions or whether a process uses an HTTP client. Use it for external prevalence and rely on internal asset data for remediation. The Filter zero is a successful query result that contributes context but does not change the product-count Exposure.
Remediation and mitigations
Build a prioritized patch queue from runtime version, client role, upstream trust and response consequence. Patch privileged and externally influenced clients first, then the remaining inventory. Rebuild images and serverless bundles, deploy the new artifacts and verify the process version and image digest.
If a high-risk client must wait, disable keep-alive for its sensitive destinations or use a dedicated Agent with connection isolation. Restrict egress, validate response schemas and add request correlation for state-changing operations. Set an explicit expiration for these temporary controls.
Track completion by deployed artifact rather than ticket status. Include the patched release, verification method, residual temporary controls and owner in the final record. That makes the fleet result useful both for this event and for future Node.js client-side security releases.
