CVE-2026-58044
Received Received - Intake

Request Desynchronization in Node.js HTTP Client

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: HackerOne

Description
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-58044
EUVD
EUVD-2026-52563

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nodejs node.js 22
nodejs node.js 24
nodejs node.js 26

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a flaw in Node.js HTTP client that causes request desynchronization in forwarding proxies. It occurs when proxies rebuild outbound headers from IncomingMessage headers while piping the original body to a reused backend connection. Node.js may omit headers beyond maxHeadersCount or maxHeaderPairs, but still uses them internally for HTTP message framing, potentially hiding headers like Content-Length while the body is delivered.

Detection Guidance

Detection requires checking Node.js versions and proxy configurations. Inspect Node.js applications using forwarding proxies for header handling logic. Monitor for desynchronized requests or missing headers in logs.

Impact Analysis

This vulnerability could allow an attacker to manipulate HTTP requests by hiding critical headers like Content-Length, leading to desynchronization between headers and body content. This might cause proxies to forward malformed requests, potentially bypassing security controls or causing unexpected behavior in backend systems.

Compliance Impact

The vulnerability could potentially impact compliance with GDPR or HIPAA if it leads to unauthorized data exposure or integrity issues during HTTP request processing. However, the provided CVE details do not explicitly address compliance implications.

Mitigation Strategies

Upgrade Node.js to patched versions if available. Review proxy configurations to ensure headers are correctly handled. Disable or restrict forwarding proxies until fixes are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58044. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart