EUVD-2026-68923
GHSA-44cw-v76j-7fvv
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Scope changes to the backend server (S:C) and both confidentiality and integrity are at risk from smuggled requests; AC:H reflects the specific proxy architecture required.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
AnalysisAI
HTTP request smuggling in Node.js's HTTP client module enables forwarding proxies to desynchronize backend connections when request headers exceed the maxHeadersCount or maxHeaderPairs thresholds. When a Node.js-based proxy rebuilds outbound request headers from the visible IncomingMessage properties and pipes the original body over a reused backend connection, framing-critical headers such as Content-Length are silently omitted from the proxy's outbound request while still governing body delivery internally - causing the backend to misparse the request stream. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions simultaneously: (1) a Node.js process acting as an HTTP forwarding proxy, not merely an application server; (2) the proxy must rebuild outbound request headers from IncomingMessage properties (req.headers, req.rawHeaders, or req.headersDistinct) rather than forwarding raw socket bytes; (3) the proxy must pipe the request body to a reused (keep-alive) persistent backend connection; and (4) the attacker must be able to send a request with enough headers to push Content-Length beyond the maxHeadersCount or maxHeaderPairs limit. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low to moderate and highly architectural. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today