Mongoose CVE-2026-73257

Exploitation requires that the vulnerable Mongoose instance (pre-7.22) sits behind a reverse proxy or load balancer that resolves request length using Content-Length while Mongoose prioritizes Transfer-Encoding: chunked - this interpretation mismatch IS the required condition. The attacker crafts a request containing both Content-Length and Transfer-Encoding: chunked headers. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N). The key limiting factor: a direct-to-Mongoose deployment with no fronting proxy, or a proxy that already rejects/normalizes dual-header requests, is not exploitable via this desync - so realistic risk hinges on the actual front-end topology, not merely on running a vulnerable Mongoose version.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) presents this as a network-reachable, unauthenticated, low-complexity issue with high confidentiality and integrity impact and no availability impact - consistent with smuggling that reads/alters other users' requests but does not crash the service. One important caveat: exploitation is not truly condition-free. The desync only manifests when Mongoose is deployed behind a reverse proxy whose Content-Length/Transfer-Encoding interpretation differs from Mongoose's chunked preference; a direct-to-Mongoose deployment with no fronting proxy is not smuggleable this way. That real-world prerequisite arguably warrants higher attack complexity than AC:L suggests. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified from the input; treat this as a credible, patch-worthy issue but prioritize it according to whether affected devices actually sit behind a CL-preferring proxy. Signals are broadly consistent (high CVSS, confirmed vendor patch); the main uncertainty is deployment-topology dependence, not conflicting data.

An attacker sends a single HTTP request to a Mongoose-backed application fronted by a Content-Length-preferring reverse proxy, including both a Content-Length header and Transfer-Encoding: chunked. The proxy forwards what it considers one request while Mongoose parses the chunked body and treats trailing bytes as the start of a second, smuggled request, which is then attributed to another user's connection - allowing the attacker to poison responses, hijack requests, or access/modify resources in another user's context. No public exploit code is identified at time of analysis, but the CL.TE technique is well-documented and low-complexity.