Loading vulnerability…
HTTP request smuggling via Node.js header truncation
CVE-2026-58044 is an HTTP request desynchronization vulnerability affecting Node.js-based forwarding proxies. Node.js can omit headers exceeding maxHeadersCount or maxHeaderPairs from the application-visible IncomingMessage collections req.headers, req.rawHeaders, and req.headersDistinct while continuing to use those headers internally for message framing. In particular, Content-Length can be hidden from application code even though the request body is still delivered. A proxy that reconstructs outbound headers from these truncated collections while piping the original body to a reused backend connection can introduce inconsistent request boundaries and enable request smuggling. Affected supported release lines include Node.js 22, 24, and 26.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can cause a susceptible forwarding proxy and its backend to disagree about HTTP request boundaries, enabling request smuggling or unintended request interpretation on reused backend connections. The vulnerability is assessed as having low integrity impact and high attack complexity; confidentiality and availability impacts are not established.
If you can’t patch tonight, do this now.
Until patched, avoid proxy implementations that rebuild outbound headers from potentially truncated IncomingMessage header collections while forwarding the original body over persistent backend connections. Enforce header-count limits at the ingress layer and reject requests exceeding those limits rather than silently omitting headers. Do not forward requests when framing-related headers may be absent from the application-visible collections.
Patch, then assume compromise.
Upgrade to Node.js 22.23.2, 24.18.1, or 26.5.1, or a later patched release in the corresponding release line. For distribution-managed installations, apply the applicable vendor security update; Alpine nodejs-current is fixed in 26.5.1-r0 or later. Update embedded Node.js runtimes and affected buildpacks through their vendor-supported security releases.
No validated public exploits yet. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.