What is the CVSS score of CVE-2026-58044?

CVE-2026-58044 has a CVSS 3.0 base score of 3.7 (Low). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-58044?

Yes, a patch is available for CVE-2026-58044. Update the affected software to the latest version immediately.

Node.js CVE-2026-58044

EUVD-2026-52563 LOW

HTTP Request/Response Smuggling (CWE-444)

2026-07-29

GHSA-6hff-9f4h-85xm

Information Disclosure Request Smuggling

3.7

CVSS 3.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

High complexity reflects mandatory chained-proxy topology for smuggling; integrity-only Low impact from injected request; no confidentiality or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 04, 2026 - 01:24 vuln.today

Analysis Generated

Aug 04, 2026 - 01:24 vuln.today

CVSS changed

Aug 04, 2026 - 01:22 NVD

3.7 (LOW)

CVE Published

Jul 29, 2026 - 14:02 github-releases

LOW 3.7

CVE Published

Jul 29, 2026 - 14:02 github-releases

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

HTTP request smuggling exposure in Node.js 26.x arises because the HTTP server failed to reject incoming requests that exceed the configured maximum header count, creating an inconsistent parsing boundary exploitable by adversaries. Rated Low severity (CVSS 3.7) by the Node.js security team and fixed in v26.5.1 released 2026-07-29, the flaw is classified under CWE-444 and is most dangerous in reverse-proxy deployments where header-count enforcement differs between the frontend proxy and the Node.js backend. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

CWE-444 (Inconsistent Interpretation of HTTP Requests - HTTP Request Smuggling) describes vulnerabilities where two HTTP stack components disagree on message boundaries or structural limits. Here, Node.js's built-in http module (commit 064d339f56, nodejs-private/node-private#922) accepted requests containing more headers than the maximum threshold rather than responding with an error. The llhttp parser dependency was simultaneously updated to 9.4.3 (commit af0bf96877), suggesting the underlying parsing layer may also have been hardened. The combination allows a carefully crafted upstream request to appear structurally valid to a frontend proxy while Node.js interprets header count differently, a classic smuggling precondition. No CPE string is yet published (pre-NVD disclosure); affected software is Node.js v26.x prior to v26.5.1.

RemediationAI

The primary fix is upgrading Node.js to v26.5.1 or later, available at https://github.com/nodejs/node/releases/tag/v26.5.1 and documented at https://nodejs.org/en/blog/vulnerability/july-2026-security-releases. The patch (commit 064d339f56) adds explicit rejection of requests that exceed the maximum header count in the http module; the concurrent llhttp 9.4.3 update also hardens the parser layer. As a compensating control where immediate upgrade is not feasible, deploying a hardened reverse proxy (nginx, HAProxy, or a WAF) that enforces strict header-count limits upstream of Node.js will reduce the smuggling differential that makes this class of attack viable - though this does not eliminate the underlying flaw and introduces an additional hop requiring its own patching cadence. Restricting direct external exposure of Node.js HTTP ports (ensuring all traffic passes through a proxy that enforces RFC-compliant header limits) is a practical interim measure.