Matteo Collina, maintainer of Node.js's HTTP stack and undici, reflects on CVE-2026-48931 — an HTTP/1.1 response queue poisoning issue in http.Agent. He argues the fix (a freeSocketDataGuard) was good hardening but should never have been classified as a CVE, because the underlying race is an inherent HTTP/1.1 protocol property shared by every client, not a Node.js-specific bug. The guard he wrote introduced a publicly observable 'data' listener on idle sockets, which caused node-fetch@2 to emit false ERR_STREAM_PREMATURE_CLOSE errors, breaking Google API auth, Firebase CLI, Backstage, and official Node.js Docker images. A follow-up fix replaced the public listener with an internal onread hook. He also discusses the broader structural problem: AI-generated security reports that pass all surface checks are flooding maintainers, making shallow reviews more likely and causing well-intentioned but misclassified CVEs.
Table of contents
What the issue actually isWhy I no longer think this was a vulnerabilityThe fix is still good. Keep itWhat I broke, and howWhat I should have doneWhy this happens, and why human in the loop is not enoughReferences251K Impressions3 Comments