CVE-2026-48932
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| nodejs | node | 22.22.3 <= 22.22.3 | affected |
| nodejs | node | 24.16.0 <= 24.16.0 | affected |
| nodejs | node | 26.3.0 <= 26.3.0 | affected |
Weaknesses
- CWE-444: CWE-444 HTTP Request Smuggling
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.