CVE-2026-48931: nodejs node
CVSS: 3.7v3.0LowModified
AliasesALPINE-CVE-2026-48931UBUNTU-CVE-2026-48931DEBIAN-CVE-2026-48931CGA-5v5w-cc4q-gcp3CGA-7c6f-ff68-28wgCGA-9945-9hmh-rmgwCGA-ccrf-g2j5-8h5cCGA-f6cm-jfxr-v4c9CGA-qw9v-j4c7-qwhqCGA-rgwg-qjhh-293gCGA-rhjr-v23x-w88f
Published 22-06-2026Last modified 03-07-2026
Vulnerability summary
CVE-2026-48931 is a low (CVSS 3.7) vulnerability in nodejs node. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
3.7/10
010
Low · v3.0 (CVE.org)EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 23 · Related 14MGASA-2026-0257OPENSUSE-SU-2026:11110-1OPENSUSE-SU-2026:11121-1OPENSUSE-SU-2026:21058-1OPENSUSE-SU-2026:21236-1RHSA-2026:35841RHSA-2026:35842RHSA-2026:35891RHSA-2026:35892RHSA-2026:39246RHSA-2026:39868RHSA-2026:41947RHSA-2026:52399SUSE-SU-2026:22368-1SUSE-SU-2026:22565-1SUSE-SU-2026:2633-1SUSE-SU-2026:2647-1SUSE-SU-2026:2695-1SUSE-SU-2026:3929-1SUSE-SU-2026:3930-1SUSE-SU-2026:4248-1SUSE-SU-2026:4261-1SUSE-SU-2026:4355-1
Timeline
- 22-06-2026PublishedVulnerability first disclosed.
- 03-07-2026Last modifiedVulnerability information updated.
Description
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS metrics
9 scores · 7 sources · 2 versionsLow 3.7Preferred score · OSV · Alpine (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Low 3.7Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated3.7LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated3.7LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated3.7LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVDNIST3.7LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 20-09-2026
20-09-202620-10-2026
EPSS score0.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNode
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- nodejs-16All versions (No fix recorded)
- nodejs-18All versions (No fix recorded)
- nodejs-20All versions (No fix recorded)
- nodejs-25All versions (No fix recorded)
Wolfi4 products
- nodejs-16All versions (No fix recorded)
- nodejs-18All versions (No fix recorded)
- nodejs-20All versions (No fix recorded)
- nodejs-25All versions (No fix recorded)
Alpine1 product
- nodejs< 22.23.0-r0 | < 24.17.0-r0
Debian1 product
- nodejs< 18.20.4+dfsg-1~deb12u3 | < 20.19.2+dfsg-1+deb13u3 | < 24.17.0+dfsg+~cs24.13.2-1
Ubuntu1 product
- nodejsAll versions (No fix recorded)
6 vendors · 13 products
