CVE-2026-48932

Name of the Vulnerable Software and Affected Versions Node.js version 22 Node.js version 24 Node.js version 26

Description A flaw in the HTTP client can cause request desynchronization for forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js may omit headers that exceed maxHeadersCount or maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, yet continue to use these omitted headers internally for HTTP message framing. Specifically, the Content-Length header can be hidden from the userland while the request body is still delivered.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.