CVE-2026-48932: Low severity nodejs/HTTP client vulnerability
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected pattern is a Node.js-based forwarding proxy that rebuilds outbound headers from the visible IncomingMessage header fields while piping the original request body over a reused backend connection. Node.js 22, 24, and 26 supported release lines are affected.
What conditions are needed for exploitation?
An attacker must be able to send a request whose framing-relevant header, particularly Content-Length, falls beyond the configured maxHeadersCount or maxHeaderPairs limit. The proxy must then forward the body while reconstructing headers from the incomplete userland-visible header set to a reused backend connection.
Are applications that only inspect req.headers protected?
No. Headers beyond the configured limit can be absent from req.headers, req.rawHeaders, and req.headersDistinct, while Node.js still uses them internally for HTTP message framing and delivers the associated body.