CVE-2026-105481

CVE-2026-105481 is an HTTP request-response ordering vulnerability affecting the Node.js JavaScript runtime environment. The flaw impacts the 22.x, 24.x, and 26.x release lines. It occurs within HTTP keep-alive connections, where a keep-alive socket can mistakenly process an incoming response that was written and sent before the corresponding request was actually dispatched. To address this issue, Node.js released security updates on October 21, 2026, which include versions 22.23.4, 24.22.1, and 26.12.1. The patch, developed by James M. Snell, ensures that the HTTP agent's data guard functions correctly without relying on I/O operations. Users are advised to upgrade their Node.js installations to these patched versions to resolve the request-response ordering flaw.