Bug 2515310 - CVE-2026-48931 nodejs22: Node.js HTTP Agent: Information disclosure due to premature response acceptance [fedora-all]
Summary: CVE-2026-48931 nodejs22: Node.js HTTP Agent: Information disclosure due to pr...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: nodejs22
Version: rawhide
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
Assignee: Jan Staněk
QA Contact:
URL:
Whiteboard: {"flaws": ["d2e33fef-1fd5-45c4-8627-3...
Depends On:
Blocks: CVE-2026-48931
TreeView+ depends on / blocked
 
Reported: 2026-08-13 13:27 UTC by Srikanth Balasubramanian
Modified: 2026-08-13 13:27 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Srikanth Balasubramanian 2026-08-13 13:27:57 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Note You need to log in before you can comment on or make changes to this bug.