CVE-2026-58044: 
npm vulnerability analysis and mitigation

CVE-2026-58044 is an HTTP request smuggling vulnerability in the Node.js HTTP client caused by header truncation in forwarding proxy scenarios. When Node.js omits headers beyond the maxHeadersCount / maxHeaderPairs limit from userland-visible properties (req.headers, req.rawHeaders, req.headersDistinct) while still using those headers internally for HTTP message framing, a forwarding proxy that rebuilds outbound headers from the visible set can forward a desynchronized request to a reused backend connection. Specifically, Content-Length can be hidden from userland while the request body is still delivered, causing a mismatch between what the proxy forwards and what the backend expects. It affects Node.js 22 (≤22.23.1), Node.js 24 (≤24.18.0), and Node.js 26 (≤26.5.0). Disclosed on July 29, 2026 and published to NVD on August 4, 2026, it carries a CVSS v3.0 base score of 3.7 (Low) (Node.js Advisory, GitHub Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). Node.js enforces maxHeadersCount / maxHeaderPairs limits by truncating headers exposed to userland, but continues to use the full, untruncated header set internally for HTTP message framing. A Node.js-based forwarding proxy that reads IncomingMessage headers to reconstruct outbound requests will therefore omit critical framing headers — most notably Content-Length — while the original request body is still piped to a reused backend connection. This desynchronization allows an attacker to craft requests with headers exceeding the configured limit, causing the backend to misinterpret message boundaries. Exploitation requires a specific deployment pattern: a Node.js proxy that rebuilds headers from req.headers (or equivalent) and reuses backend connections, making the attack complexity high (Node.js Advisory, GitHub Advisory).

Successful exploitation can cause request desynchronization on backend connections, enabling HTTP request smuggling or response corruption. The primary impact is on integrity (Low per CVSS), as an attacker could potentially poison backend request queues, cause responses to be delivered to the wrong client, or bypass security controls enforced at the proxy layer. There is no direct confidentiality or availability impact per the CVSS assessment, though in complex proxy chains, smuggled requests could be leveraged for further attacks such as cache poisoning or unauthorized access to backend resources (GitHub Advisory, Node.js Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The NVD SSVC assessment confirms exploitation is "none" and the vulnerability is not automatable due to the high attack complexity and specific deployment preconditions required. The EPSS score is approximately 0.28–0.30%, placing it in the 23rd percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate a Node.js-based forwarding proxy (Node.js 22 ≤22.23.1, 24 ≤24.18.0, or 26 ≤26.5.0) that rebuilds outbound HTTP headers from req.headers / req.rawHeaders and reuses backend connections (HTTP keep-alive).
2. Craft oversized header request: Send an HTTP request to the proxy containing a large number of headers that exceeds the proxy's configured maxHeadersCount (default: 2000) or maxHeaderPairs limit, ensuring that a Content-Length header is placed beyond the truncation boundary.
3. Trigger header truncation: The Node.js HTTP parser exposes only the headers within the limit to userland; the Content-Length header is omitted from req.headers but is still used internally for body framing and delivery.
4. Cause proxy desynchronization: The forwarding proxy, reading only visible headers, reconstructs the outbound request without Content-Length, while the full body is still piped to the reused backend connection — causing the backend to misinterpret the message boundary.
5. Achieve smuggling: The backend interprets the trailing body data as the beginning of a new, attacker-controlled HTTP request, potentially allowing cache poisoning, response hijacking, or unauthorized access to backend endpoints (Node.js Advisory, GitHub Advisory).

• Network: HTTP requests to a Node.js proxy with an unusually large number of headers (approaching or exceeding maxHeadersCount / maxHeaderPairs limits); requests where Content-Length is present in the raw TCP stream but absent in proxy-forwarded headers.
• Logs: Proxy access logs showing requests with anomalous header counts; backend server logs recording unexpected or malformed requests arriving on keep-alive connections without a corresponding proxy log entry; HTTP 400 or parsing errors on the backend following legitimate-looking proxy requests.
• Process/Application: Unexpected response mismatches reported by backend services (responses delivered to wrong clients); cache poisoning indicators such as unexpected content served from cached responses.

Update Node.js to the patched versions: v22.23.2, v24.18.1, or v26.5.1, which address this vulnerability along with other security fixes released on July 29, 2026 (Node.js Advisory). As a workaround prior to patching, review and adjust maxHeadersCount / maxHeaderPairs configurations to reduce the risk of header truncation, and implement request validation at proxy boundaries to detect suspicious header patterns or Content-Length mismatches. Avoid rebuilding outbound headers solely from req.headers in forwarding proxy implementations; instead, use the raw, untruncated header set or validate framing headers independently.

The Node.js July 2026 security release addressed 11 CVEs in total, with CVE-2026-58044 rated Low severity. Security news outlets including CyberSecurityNews and CyberPress covered the broader release, noting the range of vulnerabilities fixed across the 22.x, 24.x, and 26.x release lines. HeroDevs published a blog post summarizing the July 2026 security release and its implications for Node.js 18 and 20 end-of-life users. SUSE, openSUSE, and Amazon Linux 2023 issued downstream security advisories incorporating the patched Node.js versions. No significant controversy or researcher debate specific to CVE-2026-58044 has been observed, consistent with its Low severity rating and absence of public exploitation.