EUVD-2026-38344
GHSA-w88c-7765-q5gg
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H for inherent race condition timing requirement; C:L added over official C:N to reflect 'Information Disclosure' tag - misrouted responses may leak sensitive data.
Primary rating from Vendor (CNA).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Response queue poisoning in Node.js http.Agent allows network-accessible attackers to corrupt the HTTP keep-alive connection pool via a TOCTOU race condition, causing responses to be delivered to the wrong request handler. Affected is Node.js v26.x prior to v26.3.1, as disclosed in the June 2026 security release. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Node.js application (v26.x before v26.3.1) uses http.Agent with keep-alive connection reuse enabled (which is the default for http.globalAgent) and issues concurrent or pipelined HTTP requests over the same persistent connection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Official CVSS 3.0 score is 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N), indicating low real-world urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operating a malicious or compromised HTTP server sends crafted responses timed to coincide with concurrent in-flight requests from a Node.js application using a shared http.Agent with keep-alive enabled. By exploiting the TOCTOU race in the response queue, the attacker causes the Node.js client to deliver the server's response to the callback of a different, unrelated pending request, potentially exposing that other request's expected response data or corrupting application logic that relies on correct response routing. … |
| Remediation | Upgrade to Node.js v26.3.1 or later, which contains the patched http.Agent response queue logic and the updated llhttp 9.4.2 dependency. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
Hostname validation bypass in Node.js (versions 22.22.3, 24.16.0, and 26.3.0) lets attackers smuggle embedded NUL bytes
Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrict
Denial of service in Node.js 26.x (fixed in 26.3.1) arises from an unguarded integer overflow when computing WebCrypto c
Denial of service in Node.js HTTP/2 lets a remote peer exhaust process memory by driving unbounded growth of the connect
Sensitive information disclosure in Node.js (versions 26.3.0, 24.16.0, and 22.22.3) leaks embedded proxy credentials whe
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unha
Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostnam
TLS SNI context matching in Node.js performs case-sensitive hostname comparison, enabling network-accessible low-privile
TLS session resumption in Node.js fails to bind reusable sessions to the originally authenticated host, enabling an info
Node.js permission model bypass via FileHandle.utimes() allows local low-privilege users to modify file timestamps on pa
Node.js Permission Model fails to apply net scope guards to pipe open and chmod operations, enabling a local authenticat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today