CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una falla en el cliente HTTP de Node.js puede causar una desincronización de solicitudes para proxies de reenvío basados en Node.js que reconstruyen los encabezados salientes a partir de los encabezados visibles de ’IncomingMessage’ mientras canalizan el cuerpo original a una conexión de backend reutilizada. Node.js puede omitir encabezados más allá de ’maxHeadersCount’ / ’maxHeaderPairs’ de ’req.headers’, ’req.rawHeaders’ y ’req.headersDistinct’, mientras sigue utilizando esos encabezados omitidos internamente para el encuadre de mensajes HTTP. En particular, ’Content-Length’ puede ocultarse de userland mientras el cuerpo de la solicitud aún se entrega. Esta vulnerabilidad afecta a todas las líneas de lanzamiento compatibles: Node.js 22, Node.js 24 y Node.js 26.

Information

Published : 2026-08-04 01:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-58044

Mitre link : CVE-2026-58044

CVE.ORG link : CVE-2026-58044

JSON object : View

Products Affected

No product.

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2026-58044", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58044", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T14:19:38.226326Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "nodejs", "product": "node", "versions": [{"status": "affected", "version": "26.5.0", "versionType": "semver", "lessThanOrEqual": "26.5.0"}, {"status": "affected", "version": "24.18.0", "versionType": "semver", "lessThanOrEqual": "24.18.0"}, {"status": "affected", "version": "22.23.1", "versionType": "semver", "lessThanOrEqual": "22.23.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-04T01:16:20.247", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "source": "support@hackerone.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\r\n\r\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."}, {"lang": "es", "value": "Una falla en el cliente HTTP de Node.js puede causar una desincronizaci\u00f3n de solicitudes para proxies de reenv\u00edo basados en Node.js que reconstruyen los encabezados salientes a partir de los encabezados visibles de \u2019IncomingMessage\u2019 mientras canalizan el cuerpo original a una conexi\u00f3n de backend reutilizada.\n\nNode.js puede omitir encabezados m\u00e1s all\u00e1 de \u2019maxHeadersCount\u2019 / \u2019maxHeaderPairs\u2019 de \u2019req.headers\u2019, \u2019req.rawHeaders\u2019 y \u2019req.headersDistinct\u2019, mientras sigue utilizando esos encabezados omitidos internamente para el encuadre de mensajes HTTP. En particular, \u2019Content-Length\u2019 puede ocultarse de userland mientras el cuerpo de la solicitud a\u00fan se entrega.\n\nEsta vulnerabilidad afecta a todas las l\u00edneas de lanzamiento compatibles: Node.js 22, Node.js 24 y Node.js 26."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "support@hackerone.com"}