CVE-2026-48932
Received Received - Intake

HTTP Request Desynchronization in Node.js

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: HackerOne

Description
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-48932
EUVD
EUVD-2026-68923

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nodejs node.js 22
nodejs node.js 24
nodejs node.js 26

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a flaw in Node.js HTTP client that causes request desynchronization in forwarding proxies. It occurs when proxies rebuild outbound headers from IncomingMessage headers while piping the original body to a reused backend connection. Node.js may hide headers beyond maxHeadersCount or maxHeaderPairs from userland but still use them internally for HTTP message framing, such as hiding Content-Length while delivering the request body.

Impact Analysis

This vulnerability can lead to request desynchronization, potentially causing incorrect data transmission or miscommunication between systems. It may result in improper handling of headers like Content-Length, which could affect how requests are processed by backend services.

Mitigation Strategies

Update Node.js to the latest patched version for your release line (22, 24, or 26) to address the header desynchronization flaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48932. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart