Node.js CVE-2026-105481

The affected component is the Node.js HTTP Agent's internal data guard; the fix ensures that guard functions even without I/O. The available sources do not state the exact feature toggle, protocol condition, or configuration required to trigger the flaw, so no concrete prerequisite beyond use of the HTTP Agent can be asserted. Limiting factors per the CVSS vector: high attack complexity (AC:H) indicates a timing/race window the attacker must win, which materially reduces practical exploitability, while no authentication (PR:N) and no user interaction (UI:N) are required and the vector is network-reachable (AV:N). Exploitation is further bounded to Node.js versions at or below 22.23.3, 24.22.0, and 26.12.0 as listed in the EUVD data.

This is CVE-2026-105481 specifically - the 'http: ensure agent data guard works without I/O' fix, which the Node.js vendor release notes label 'Medium', distinct from the several 'High' CVEs bundled in the same v26.12.1 release. The supplied CVSS is 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N): network-reachable with no authentication or user interaction, but high attack complexity. CWE-367 (TOCTOU race condition) is consistent with the AC:H rating, though the available sources do not actually describe the trigger mechanism. On exploitation signals: not listed in CISA KEV, so there is no confirmed active exploitation; a public PoC reference exists (a GitHub gist tagged as exploit) but it is not verified as working exploit code; no EPSS score is provided in the input, so exploitation probability cannot be quantified. The vuln.today decision label is 'this_month' - a routine priority, not act_now or emergency. Note a data conflict: the provided vector asserts I:H (high integrity impact) while the tags describe this as 'Information Disclosure' (a confidentiality concern) - the two signals disagree and the C:L/I:H combination is unusual for an HTTP-agent data-guard fix; this discrepancy should be verified against the Node.js advisory. Net: a real but non-urgent issue - patch during the normal maintenance cycle.

A remote, unauthenticated attacker interacts with a Node.js service that uses the HTTP(S) Agent and attempts to exploit a time-of-check/time-of-use race in the agent's data guard to access data that should have been isolated. The high attack complexity (AC:H) means the attacker must reliably win a timing window, so exploitation is not trivial. A public PoC reference exists but is not verified as working exploit code, so weaponized exploitation is not demonstrated.