CVE-2026-58044: 
Node.js Schwachstellenanalyse und -minderung

CVE-2026-58044 is an HTTP parser header truncation vulnerability in Node.js that can enable HTTP request smuggling. The flaw affects Node.js HTTP client handling in the 22.x, 24.x, and 26.x release lines. It was disclosed on July 29, 2026, as part of a batch security release. The vulnerability is rated Low severity by the Node.js project (Node.js Advisory). No official CVSS score has been published yet, though Feedly estimates the severity as HIGH (Feedly).

The root cause is improper handling of HTTP headers that exceed the configured maxHeadersCount / maxHeaderPairs limit (CWE-444: Inconsistent Interpretation of HTTP Requests). Node.js omits headers beyond this limit from req.headers, req.rawHeaders, and req.headersDistinct — making them invisible to userland code — while still using those omitted headers internally for HTTP message framing. Critically, a Content-Length header can be hidden from application-layer inspection while the request body is still delivered based on it. This creates a desynchronization condition exploitable in Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection (Node.js Advisory).

Successful exploitation allows an attacker to perform HTTP request smuggling against Node.js-based forwarding proxies, potentially causing a frontend proxy to forward a request with a different body length than the backend expects. This can lead to cache poisoning, unauthorized access to other users' requests, security control bypass, or injection of malicious content into proxied responses. The impact is primarily on confidentiality and integrity of HTTP traffic passing through affected proxy configurations (Node.js Advisory).

1. Identify target: Locate a Node.js-based HTTP forwarding proxy (e.g., a custom reverse proxy built with Node.js http module) that reads req.headers to reconstruct outbound request headers and pipes the original request body to a reused backend connection.
2. Craft a malicious request: Construct an HTTP request containing more headers than the server's configured maxHeadersCount (default: 2000) or maxHeaderPairs limit, placing a Content-Length header beyond the truncation threshold so it is omitted from req.headers but still processed internally by the HTTP parser.
3. Send the request: Deliver the crafted request to the Node.js proxy. The proxy rebuilds outbound headers from the truncated req.headers (missing Content-Length), while the body is still delivered to the backend based on the hidden Content-Length value.
4. Achieve desynchronization: The mismatch between the headers the backend receives and the body length causes the backend to misinterpret the boundary between requests on a reused connection, enabling request smuggling — potentially poisoning shared caches or hijacking other users' sessions (Node.js Advisory).

• Network: HTTP requests with an unusually large number of headers (approaching or exceeding 2000) sent to a Node.js proxy; unexpected Content-Length discrepancies between frontend and backend access logs on the same connection.
• Logs: Backend server logs showing requests with body sizes inconsistent with the headers logged by the Node.js proxy; unexpected HTTP 400/500 errors from the backend on keep-alive connections following large-header requests.
• Application Behavior: Unexpected responses served to users that appear to contain content from another user's request; cache entries containing injected or unexpected content.

The Node.js project has released patched versions addressing CVE-2026-58044: v22.23.2, v24.18.1, and v26.5.1, all released on July 29, 2026. Users should upgrade to the appropriate patched release for their release line as the primary remediation. As a workaround, operators of Node.js-based forwarding proxies can set maxHeadersCount to a low value and explicitly validate or reject requests where Content-Length is absent from req.headers before forwarding. Disabling HTTP keep-alive on backend connections also mitigates the smuggling risk (Node.js Advisory).

The vulnerability was reported by researcher yushengchen and fixed by Node.js core maintainer mcollina, as credited in the official advisory. Security news outlets including CyberSecurityNews, CyberPress, and The Daily Tech Feed covered the broader July 2026 Node.js security release batch, noting 11 vulnerabilities were addressed. The apereo/CAS project was observed committing a fix referencing this CVE shortly after disclosure, indicating downstream ecosystem impact (CyberSecurityNews, Node.js Advisory).