Node.js CVE-2026-58044

Exploitation requires Node.js 26.x prior to v26.5.1 to be deployed behind a reverse proxy or load balancer (nginx, HAProxy, AWS ALB, Cloudflare, etc.) that does not independently enforce or enforce differently the same maximum-header-count limit. Without a fronting intermediary, the smuggling differential cannot be operationalized. Attack complexity is rated High (AC:H) by the vendor's CVSS vector, reflecting this chained-proxy requirement. No authentication is required (PR:N), and no user interaction is needed (UI:N). Exploitation is limited to the Current (v26.x) release line based on available data; LTS line exposure is not confirmed. The vulnerability does not affect configurations where Node.js is directly internet-exposed without a proxy, as smuggling requires two discordant parsers.

CVSS 3.7 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N positions this as network-reachable but requiring high attack complexity - consistent with HTTP smuggling attacks that demand a specific chained-proxy topology to be effective. Integrity impact is rated Low: the realistic outcome is request smuggling rather than direct data exfiltration or service disruption. No EPSS score is provided in the input data. No KEV listing exists, and no public proof-of-concept has been identified, suggesting exploitation remains theoretical or at most targeted. In isolation (direct Node.js exposure without a fronting proxy), the practical attack surface is very limited because the smuggling differential cannot be leveraged without a second, inconsistently behaving parser in the chain. Environments running Node.js 26.x behind nginx, HAProxy, or cloud load balancers with different header-limit policies carry meaningfully higher real-world risk than the raw CVSS score implies.

An attacker positioned to send HTTP requests to a Node.js 26.x application behind a reverse proxy crafts a request containing more headers than the Node.js maximum-header-count threshold. The frontend proxy, which enforces a different or absent header-count limit, forwards the request intact; Node.js, previously lacking rejection logic, processes the oversized header block and interprets message boundaries inconsistently, allowing a second, smuggled request to be injected into the pipeline and processed as a separate, potentially attacker-controlled transaction. No public proof-of-concept has been identified at time of analysis.