CVE-2026-58044: HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Other sources
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2Fixed in 24.18.1Fixed in 26.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.5.1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.2-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.18.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.5.1-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-58044?
The severity of CVE-2026-58044 is classified as low, rated at 3.7.
How do I fix CVE-2026-58044?
To mitigate CVE-2026-58044, it's recommended to upgrade to the latest version of Node.js that addresses this vulnerability.
Who is affected by CVE-2026-58044?
CVE-2026-58044 affects applications using Node.js 22 and 24 that utilize HTTP clients, particularly those functioning as forwarding proxies.
What type of vulnerability is CVE-2026-58044?
CVE-2026-58044 is a request desynchronization vulnerability occurring in Node.js HTTP clients.
What are the potential consequences of CVE-2026-58044?
The potential consequences of CVE-2026-58044 include incomplete request header reconstruction, which may affect application behavior and performance.