Bug 2560019 (CVE-2026-105481)

A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response is already buffered when the socket is assigned to a new request—for example because the event loop was busy with synchronous work—the guard is cleared without observing the data and the bytes are parsed as the response to the new request. This is an incomplete fix of CVE-2026-48931. A malicious or compromised peer that can write an early response on a reused connection may cause the client to accept unintended response content, affecting integrity and potentially confidentiality of application data.