All vulnerabilities
CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the origi

nodejs nodeRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
3.7Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published4 Aug 2026Updated 4 Aug 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 4 Aug 2026, 00:49 UTCPublishedCVE List
  2. 23 Oct 2026, 23:46 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.

Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

Text from CVE List

Affected versions 3

  • nodeaffected: 26.5.0 through 26.5.0CVE List
  • nodeaffected: 24.18.0 through 24.18.0CVE List
  • nodeaffected: 22.23.1 through 22.23.1CVE List

References 1