A flaw in Node.js HTTP Agent connection reuse logic allows a client to mistakenly interpret data that arrived on a socket before a request was issued as the response to that new request. The vulnerability stems from a guard that removes idle keep-alive sockets only when the event loop polls for I/O; if unsolicited data has already reached the socket and the event loop is busy with synchronous work, the guard is bypassed and the data is parsed as a legitimate response. The defect could enable an attacker to inject crafted responses into a client application, potentially leading to unauthorized code execution, malicious data processing, or other unintended behavior when the stale data is treated as legitimate. The weakness is classified under CWE-367, reflecting improper handling of unexpected input. Node.js distributed a fix in later releases; however, this incomplete patch is still present in versions 26.x, 24.x, and 22.x. The CVSS score of 6.5 indicates a moderate-to-high severity. While the EPSS score is currently unavailable, the vulnerability is not listed in CISA's KEV catalog, suggesting no widely known exploitation yet. Attackers could potentially exploit this by controlling the server that communicates with the vulnerable client, making the issue relevant to both client-side and server-side codebases, especially in high-traffic or synchronous environments.

Node.js versions 26.x, 24.x, and 22.x. The affected vendor is the Node.js project.

The moderate CVSS score signals significant potential impact if the flaw is successfully used. An attacker with control over responses on a reused keep-alive connection could cause the Node.js client to process a previous response as new, leading to data injection or malicious code execution. The risk is heightened in scenarios where the event loop is busy with CPU-bound work, allowing unsolicited data to arrive unnoticed. Although no widespread exploits are documented (not in KEV) and EPSS is not available, the theoretical exploit path remains viable.