CVE-2026-105481: 
npm vulnerability analysis and mitigation

CVE-2026-105481 is an HTTP agent data guard bypass vulnerability in Node.js 22.23.4 (LTS) where the agent data guard fails to function correctly when no I/O is available. The flaw allows unauthorized data access in applications relying on agent-level protection under low or absent I/O conditions. The CVE was inserted into Feedly's threat intelligence feed on October 21, 2026, and is currently in "Reserved" status. Patches have been issued as part of Node.js security updates covering versions 22.23.4, 24.22.1, and v26.12.1 (Node.js Release v22.23.4, Node.js Release v24.22.1, Node.js Release v26.12.1). No CVSS score has been publicly assigned at this time.

The vulnerability resides in Node.js's HTTP implementation, where the agent data guard — a mechanism intended to prevent unauthorized data exposure between requests — does not activate correctly when no I/O operations are in progress. This represents a logic or state-management flaw (potentially CWE-362: Race Condition, or CWE-755: Improper Handling of Exceptional Conditions) in the HTTP agent lifecycle. The precondition for exploitation is a scenario where I/O is constrained or absent, which may occur under specific server load or connection-handling conditions. No public technical write-up or proof-of-concept code has been identified at this time (Node.js Release v22.23.4, CyberSecurityNews).

Successful exploitation could allow an attacker to bypass the HTTP agent data guard, potentially exposing sensitive data — such as session tokens, credentials, or application data — that should be isolated between HTTP agent connections. Applications that rely on Node.js's built-in agent protection for multi-tenant or shared-connection scenarios are most at risk. The scope of impact is limited to the affected Node.js process and its HTTP agent state, but data leakage between requests could facilitate further unauthorized access or privilege escalation within the application (Node.js Release v22.23.4, CyberSecurityNews).

No evidence of in-the-wild exploitation, public proof-of-concept code, or threat actor attribution has been identified for CVE-2026-105481 at this time. The CVE remains in "Reserved" status, and no EPSS score or CISA KEV catalog entry has been published. The vulnerability requires specific I/O conditions to trigger, which may limit opportunistic exploitation but could be targeted in controlled environments (Node.js Release v22.23.4).

Node.js has released security updates addressing this vulnerability. Users should upgrade to the patched releases: Node.js 22.23.4 (LTS), 24.22.1, or v26.12.1, which include fixes for this HTTP agent data guard bypass. No specific configuration-based workaround has been publicly documented; upgrading to a patched version is the recommended remediation. Organizations using downstream projects that depend on Node.js (e.g., Apereo CAS, which issued a related commit) should also apply those upstream patches (Node.js Release v22.23.4, Node.js Release v24.22.1, Node.js Release v26.12.1, Apereo CAS Commit).

Security news outlets including CyberSecurityNews and The Daily Tech Feed covered the Node.js security update batch, noting the urgency of patching high-severity issues including TLS, DNS, Brotli, and HTTP agent-related fixes. No notable individual researcher commentary or significant social media discussion specific to CVE-2026-105481 has been identified beyond general coverage of the Node.js release cycle (CyberSecurityNews, The Daily Tech Feed).