Inconsistent interpretation of HTTP requests in Node.js - CVE-2026-58044
Published: July 29, 2026 / Updated: July 29, 2026
Vulnerability identifier: #VU140048
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-58044
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
Node.js
Node.js
Detailed vulnerability description
The vulnerability allows a remote attacker to perform request smuggling.
The vulnerability exists due to inconsistent header processing in the Node.js HTTP client when rebuilding outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection. A remote attacker can send a crafted request with hidden framing headers to perform request smuggling.
The issue affects Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections.
How to mitigate CVE-2026-58044
Install security update from vendor's website.