Which versions of Node.js are affected by EUVD-2026-19603?

Tinyproxy versions through 1.11.3 contain an HTTP request smuggling vulnerability that allows unauthenticated remote attackers to exhaust backend worker resources and bypass security controls,…

How to fix or mitigate EUVD-2026-19603?

Within 24 hours: Inventory all Tinyproxy deployments and confirm running versions against 1.11.3 or earlier; isolate or monitor these instances for unusual request patterns. Within 7 days: Implement network-level request filtering to reject HTTP requests with non-standard Transfer-Encoding header capitalization (e.g., 'Transfer-Encoding: Chunked' vs. standard lowercase), and consider deploying a WAF rule to normalize or block malformed headers. Within 30 days: Evaluate alternative reverse proxy solutions (Nginx, Apache with mod_proxy) or contact Tinyproxy maintainers for patch status; if Tinyproxy is business-critical, prepare a vendor or fork-based patch or orchestrate a controlled upgrade once remediation is available.

Node.js EUVD-2026-19603

Q: What is the CVSS score of EUVD-2026-19603?

EUVD-2026-19603 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-31842 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-04-07 TuranSec

GHSA-mh87-c4c3-cgwf

Request Smuggling Denial Of Service Nginx Node.js

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.8 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 18:52 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 11:45 euvd

EUVD-2026-19603

Analysis Generated

Apr 07, 2026 - 11:45 vuln.today

CVE Published

Apr 07, 2026 - 11:17 nvd

HIGH 8.7

DescriptionCVE.org

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer() function uses strcmp() to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive. By sending a request with Transfer-Encoding: Chunked, an unauthenticated remote attacker can cause Tinyproxy to misinterpret the request as having no body. In this state, Tinyproxy sets content_length.client to -1, skips pull_client_data_chunked(), forwards request headers upstream, and transitions into relay_connection() raw TCP forwarding while unread body data remains buffered. This leads to inconsistent request state between Tinyproxy and backend servers. RFC-compliant backends (e.g., Node.js, Nginx) will continue waiting for chunked body data, causing connections to hang indefinitely. This behavior enables application-level denial of service through backend worker exhaustion. Additionally, in deployments where Tinyproxy is used for request-body inspection, filtering, or security enforcement, the unread body may be forwarded without proper inspection, resulting in potential security control bypass.

AnalysisAI

HTTP request smuggling and denial of service in Tinyproxy through 1.11.3 allows unauthenticated remote attackers to cause backend worker exhaustion and bypass request inspection controls. The vulnerability stems from case-sensitive Transfer-Encoding header parsing that violates RFC 7230, enabling attackers to send 'Transfer-Encoding: Chunked' (capitalized) to desynchronize Tinyproxy's request state from RFC-compliant backends like Node.js and Nginx. No public exploit identified at time of analysis, though EPSS data not available and technical details are publicly documented in GitHub issue #604. Authentication requirements not confirmed from available data, but CVSS vector indicates network-accessible attack requiring no privileges.

Technical ContextAI

The vulnerability exists in Tinyproxy's src/reqs.c file, specifically in the is_chunked_transfer() function which performs case-sensitive string comparison using strcmp() against the literal 'chunked' value. RFC 7230 Section 4 mandates case-insensitive handling of transfer-coding names, meaning 'chunked', 'Chunked', and 'CHUNKED' must be treated identically. This CWE-444 (Inconsistent Interpretation of HTTP Requests) class flaw creates a state desynchronization where Tinyproxy misinterprets capitalized 'Chunked' as having no Transfer-Encoding, sets content_length.client to -1, bypasses pull_client_data_chunked() function, and immediately transitions to relay_connection() raw TCP mode. Meanwhile, RFC-compliant backend servers correctly parse the capitalized header and enter chunked transfer decoding mode, waiting indefinitely for chunk-encoded body data. The buffered but unforwarded request body remains in Tinyproxy's input stream, creating a persistent request-response desynchronization that can propagate to subsequent pipelined requests, a classic HTTP request smuggling condition vector.

RemediationAI

Review GitHub issue https://github.com/tinyproxy/tinyproxy/issues/604 for upstream development status and apply patches when vendor releases fix addressing case-insensitive Transfer-Encoding header comparison. Until patched version becomes available, implement network-layer controls to block or normalize Transfer-Encoding headers with non-lowercase values at perimeter firewalls or WAF devices. For environments requiring immediate risk reduction, consider replacing Tinyproxy with alternative proxy solutions that demonstrate RFC 7230 compliance, or deploy Tinyproxy behind a normalizing reverse proxy that enforces lowercase header canonicalization. Organizations using Tinyproxy for security inspection should audit whether request bodies are being properly validated, as existing deployments may have unknowingly allowed uninspected content through this parsing discrepancy. Monitor backend connection pools for sustained connection exhaustion patterns that may indicate exploitation attempts. Consult RFC 7230 specification at https://datatracker.ietf.org/doc/html/rfc7230 for HTTP compliance requirements and validate any custom proxy implementations against case-insensitivity requirements for transfer-coding directives.