CVE-2026-58044

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.x and earlier

Description A flaw in the Node.js HTTP client can lead to request desynchronization in Node.js-based forwarding proxies. This occurs when proxies rebuild outbound headers using visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js may omit headers that exceed the maxHeadersCount or maxHeaderPairs limits from req.headers, req.rawHeaders, and req.headersDistinct, yet continue to use these omitted headers internally for HTTP message framing. Consequently, the Content-Length header can be hidden from the application layer while the request body is still delivered.

Recommendations Update Node.js 22 to the latest patched version. Update Node.js 24 to version 24.18.1-1.1 or newer. Update Node.js 26 to version 26.5.1-1.1 or newer.