We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-48931

CVE-2026-48931

Node.js

Severity: LOW
CVSS: 3.7CVSS
Published: 2026-06-22
Last modified: 2026-06-23
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE: CWE-367

Description

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

References

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
https://github.com/nodejs/node/issues/63989
https://jdstaerk.substack.com/p/nodejs-security-fix-silently-broke

Summary

Description

References