Executive brief
Node.js HTTP clients can omit certain request headers from the visible headers object while still using them internally for HTTP framing. In forwarding proxies that rebuild headers based on what they see, an attacker can exploit this discrepancy to cause request smuggling—where the backend server interprets requests differently than intended, potentially leading to cache poisoning, request misdirection, or unauthorized access.
Technical details
This vulnerability is a header truncation flaw in the Node.js HTTP client where headers beyond maxHeadersCount / maxHeaderPairs are omitted from req.headers, req.rawHeaders, and req.headersDistinct while still being used internally for HTTP message framing. Notably, Content-Length can be hidden from userland code while the request body is still delivered to the backend. Attack vector: network, requiring no authentication. Precondition: the vulnerable code must be a Node.js-based forwarding proxy that rebuilds outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. An attacker can craft requests with truncated headers to cause request desynchronization between what the proxy sends and what the backend interprets. Patches are available in Node.js 22, 24, and 26 release lines.
Affected products
- OpenJS Foundation Node.js 22.x, 24.x, 26.x
Timeline
- 2026-08-04: disclosed: CVE-2026-58044 published on NVD
- 2026-07-29: advisory: Security release issued for Node.js 22.x, 24.x, 26.x