CVE-2026-105481: Node.js keep-alive socket processes a response that was written before the request was sent

Keep-alive lets an HTTP client send several requests over one TCP or TLS connection. Between requests the socket sits in the agent's free pool. The data guard that should catch unexpected bytes on an idle socket relied on I/O happening first, so data the server wrote while the socket was idle could stay unnoticed. When the next request took that socket, Node.js parsed the waiting bytes as its response.

The effect is response desynchronization from the client's point of view. A server that the client talks to, or anything able to write into that connection, can pre-load a response and have it attached to whatever request comes next, which may be a different user's request in a shared service or a call to a different path on the same host. Results range from wrong data and cache poisoning in proxies to leaking one caller's response to another. Exploitation needs a hostile or compromised upstream, or a proxy in the path; ordinary trusted backends do not send unsolicited bytes. The fix checks with the operating system whether anything is waiting to be read, without consuming it, and discards such sockets.

Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. Keep-alive is on by default for http.globalAgent in current Node.js lines, so most HTTP clients built on the http and https modules use socket reuse. Check versions with:

node -v
npx --yes envinfo --binaries 2>/dev/null | grep -i node
docker run --rm <your-image> node -v

Services most at risk call upstreams they do not fully trust, or act as proxies or gateways for many users.

Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1 and restart the services. The fixed agent destroys a socket with pending data and opens a new connection, so expect slightly more connection churn against servers that misbehave.

If you cannot upgrade, disable keep-alive for agents that talk to untrusted upstreams, for example new http.Agent({ keepAlive: false }), at the cost of more connections.

Signs are responses that do not match their requests: wrong content types, bodies for a different path, or one user seeing another user's data from a shared backend client. Compare upstream access logs with client logs; a response delivered to the client for a request that never reached the upstream log points at a pre-sent response.

The Node.js HTTP Agent could hand a kept-alive socket to a new request even though the server had already written data on it, so that data was read as the response to the new request. The fix asks the operating system whether bytes are waiting on the socket before reuse and, if so, destroys it and uses another connection. Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, released October 21, 2026.