Node.js CVE-2026-48932

Exploitation requires all of the following conditions simultaneously: (1) a Node.js process acting as an HTTP forwarding proxy, not merely an application server; (2) the proxy must rebuild outbound request headers from IncomingMessage properties (req.headers, req.rawHeaders, or req.headersDistinct) rather than forwarding raw socket bytes; (3) the proxy must pipe the request body to a reused (keep-alive) persistent backend connection; and (4) the attacker must be able to send a request with enough headers to push Content-Length beyond the maxHeadersCount or maxHeaderPairs limit. Direct Node.js application servers that do not forward to a backend, and proxies that tunnel raw bytes without rebuilding headers (e.g., CONNECT tunnels), are not affected. The CVSS PR:N indicates no authentication is required to send the crafted request to the proxy, but the proxy must be internet-accessible or reachable by the attacker.

Real-world risk is low to moderate and highly architectural. The CVSS 3.7 Low score with AC:H correctly captures that exploitation requires a non-trivial setup: the vulnerable pattern only manifests in Node.js-based HTTP forwarding proxies that both (a) reconstruct outbound headers from IncomingMessage and (b) reuse persistent backend connections. Standard reverse proxies such as nginx or HAProxy in front of Node.js are unaffected; only those built with Node.js itself as the forwarding layer are vulnerable. No EPSS data was provided with this advisory, and no KEV entry exists, suggesting no observed mass exploitation. No public exploit code has been identified. Despite the low score, organizations running Node.js-based API gateways or service-mesh components should audit their proxy code for the vulnerable pattern - even a mid-tier platform team operating a shared internal gateway should treat this as a configuration audit task rather than an emergency patch. The CVSS integrity impact (I:L / S:U) likely understates the potential since successful request smuggling can lead to request hijacking, cache poisoning, or cross-tenant data exposure depending on backend behavior, arguments for S:C.

An attacker sends a crafted HTTP request with a large number of headers to a Node.js-based forwarding proxy, pushing Content-Length past the maxHeadersCount limit so it is invisible to the proxy's header reconstruction logic. The proxy forwards the request to a reused backend connection without a Content-Length header, but the body bytes are still delivered according to the hidden Content-Length, causing the backend to interpret the leftover bytes as the start of a new request. No public exploit code exists; successful exploitation requires knowledge of the target proxy's architecture and backend connection reuse behavior.