A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Weakness
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Node.js | Nodejs | 22.22.3 (including) | 22.22.3 (including) |
| Node.js | Nodejs | 24.16.0 (including) | 24.16.0 (including) |
| Node.js | Nodejs | 26.3.0 (including) | 26.3.0 (including) |
| Nodejs | Ubuntu | questing | * |