CVE-2026-48931
LOWNode - Time-of-check Time-of-use (TOCTOU) Race Condition
Title source: ruleDescription
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
References (4)
Core 4
Core References
Issue Tracking
https://github.com/nodejs/node/issues/63989
Scores
CVSS v3
3.7
EPSS
0.0037
EPSS Percentile
29.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-367
Status
published
Products (6)
nodejs/node
22.22.3
nodejs/node
24.16.0
nodejs/node
26.3.0
nodejs/node.js
22.22.3
nodejs/node.js
24.16.0
nodejs/node.js
26.3.0
Published
Jun 22, 2026
Tracked Since
Jun 23, 2026