CVE-2026-27690: SAP Approuter HTTP request smuggling

Executive brief

SAP Approuter is a critical routing component used in SAP cloud applications to handle incoming HTTP requests and forward them to backend services. An unauthenticated attacker can exploit an HTTP request smuggling vulnerability by sending specially crafted requests that desynchronize how the application and backend servers interpret message boundaries. This can expose sensitive data from other users' responses and cause the service to become unavailable, impacting business continuity and customer trust.

Technical details

The vulnerability is a classic HTTP request smuggling issue (CWE-444) where SAP Approuter inconsistently interprets malformed or ambiguous HTTP request headers compared to the backend servers it proxies to. An attacker can send a specially crafted request that the Approuter interprets as a single request but the backend interprets differently (or vice versa), causing request-response desynchronization. No authentication is required; the attack is network-accessible. Successful exploitation allows an attacker to read responses intended for other users (confidentiality impact) and potentially disrupt service availability. The vulnerability affects versions of the npm package @sap/approuter prior to 20.10.0, which contains the fix.

Affected products

• SAP Approuter < 20.10.0

Timeline

• 2026-07-14: disclosed
• 2026-07-14: patched: Version 20.10.0 released with fix

References

• https://api.github.com/users/henrybrink
• https://github.com/henrybrink
• https://api.github.com/users/henrybrink/gists%7B/gist_id%7D
• https://api.github.com/users/henrybrink/repos
• https://avatars.githubusercontent.com/u/20884220?v=4
• https://api.github.com/users/henrybrink/events%7B/privacy%7D