CVE-2026-58044 Details
Description
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A vulnerability in the Node.js HTTP client can lead to request desynchronization in Node.js-based forwarding proxies. This issue arises when the proxy rebuilds outbound headers from the visible 'IncomingMessage' headers while simultaneously piping the original body to a reused backend connection. Node.js may omit headers that exceed 'maxHeadersCount' or 'maxHeaderPairs' from 'req.headers', 'req.rawHeaders', and 'req.headersDistinct'. However, these omitted headers are still used internally for HTTP message framing, which can create discrepancies. Notably, the 'Content-Length' header can be concealed from userland while the request body is being transmitted. This vulnerability impacts all supported release lines of Node.js: 22, 24, and 26.
Users can upgrade to Node.js versions 22.23.2, 24.18.1, or 26.6.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://nodejs.org/en/blog/vulnerability/july-2026-security-releases | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |