Executive brief
Node.js HTTP client can omit headers beyond internal limits while still processing them for message framing, causing a desynchronization vulnerability in forwarding proxies. When proxies rebuild headers from visible request data while piping the original body, attackers can craft requests where critical headers like Content-Length are hidden from the proxy but still used by the HTTP layer, potentially causing the proxy to send malformed requests to backend servers and disrupting operations.
Technical details
This is a request desynchronization (HTTP request smuggling variant) vulnerability in Node.js's HTTP client implementation. The root cause is that Node.js can omit headers exceeding maxHeadersCount/maxHeaderPairs limits from the userland-visible req.headers, req.rawHeaders, and req.headersDistinct properties, while still using those omitted headers internally for HTTP message framing. An attacker can craft requests with sufficient headers to exceed these limits, causing critical headers like Content-Length to be hidden from application code but still processed by the HTTP layer. Forwarding proxies that rebuild outbound headers from the visible IncomingMessage while piping the original body to a backend connection are vulnerable. The attack requires network access and the ability to send HTTP requests; no authentication is required. The result is request desynchronization on the backend connection, potentially leading to request smuggling and cache poisoning. Patches are available for Node.js 22, 24, and 26.
Affected products
- OpenJS Foundation Node.js 22, 24, 26
Timeline
- 2026-09-01: disclosed: Publicly disclosed on NVD