CVE-2026-48932: Node.js HTTP Desynchronization Vulnerability

CVE-2026-48932 Overview

CVE-2026-48932 is an HTTP request smuggling vulnerability [CWE-444] in the Node.js HTTP client. The flaw allows request desynchronization in Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage object while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount and maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. Attackers can hide a Content-Length header from userland code while the request body is still delivered downstream. The issue affects Node.js 22, Node.js 24, and Node.js 26.

Critical Impact
Forwarding proxies built on Node.js may desynchronize with upstream servers, enabling request smuggling against reused backend connections.

Affected Products

Node.js 22 (all supported releases)
Node.js 24 (all supported releases)
Node.js 26 (all supported releases)

Discovery Timeline

2026-09-01 - CVE-2026-48932 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-48932

Vulnerability Analysis

The Node.js HTTP parser enforces maxHeadersCount and maxHeaderPairs limits on the header collection exposed to JavaScript. Headers arriving beyond these limits are dropped from the userland-visible req.headers, req.rawHeaders, and req.headersDistinct structures. The parser continues to use the full header set internally for HTTP message framing decisions. This inconsistency between the framing state and the userland view breaks the trust assumption made by forwarding proxies.

Proxy applications commonly reconstruct outbound requests from req.headers. When they pipe req directly to a pooled backend socket, the body length is governed by the framing header the proxy never observed. The upstream server frames the body using the hidden Content-Length, while the proxy uses whatever framing it constructs from the visible headers. This desynchronization poisons the reused connection and allows a following request to be interpreted from attacker-controlled bytes.

Root Cause

The root cause is state divergence between the HTTP parser's internal framing view and the JavaScript-visible header collection. Truncation of req.headers at maxHeadersCount does not propagate to the framing logic, violating the invariant that userland sees every header that governs message boundaries. This is a classic HTTP Request/Response Smuggling weakness [CWE-444].

Attack Vector

An attacker sends a crafted HTTP request with enough header fields to push Content-Length past maxHeadersCount. A Node.js forwarding proxy rebuilds the outbound request from the visible headers, omits Content-Length, and forwards the request over a pooled keep-alive connection. The backend consumes the body using the hidden length, while the proxy believes the message ended earlier. The residual bytes on the reused socket become the prefix of the next victim request, enabling cache poisoning, credential theft, or bypass of security controls.

Refer to the HackerOne Report #3564941 for the reporter's technical breakdown.

Detection Methods for CVE-2026-48932

Indicators of Compromise

Requests containing an unusually large number of header fields, especially where Content-Length or Transfer-Encoding appears past the 2000th header pair.
Backend responses arriving on a proxy connection that do not correlate to any request logged by the proxy.
Cache entries whose stored response body begins with valid HTTP request bytes (GET , POST , Host:).

Detection Strategies

Instrument forwarding proxies to compare header counts reported by req.rawHeaders.length / 2 against the byte length of the raw request preamble read from the socket.
Deploy WAF or reverse-proxy rules that reject requests exceeding a conservative header count threshold before they reach Node.js.
Correlate proxy access logs with upstream logs to surface request/response pairing gaps that suggest smuggled traffic.

Monitoring Recommendations

Alert on Node.js process versions still running vulnerable 22.x, 24.x, or 26.x builds across the fleet.
Track error rates and latency anomalies on proxy tiers, which often spike when smuggled requests corrupt pooled connections.
Monitor for HTTP parser warnings emitted by Node.js and forward them to centralized logging for review.

How to Mitigate CVE-2026-48932

Immediate Actions Required

Upgrade Node.js to the patched release on the 22, 24, and 26 lines as soon as fixed builds are available from the Node.js Security team.
Audit any in-house or third-party Node.js proxy code that pipes req to http.request while rebuilding headers from req.headers.
Terminate keep-alive on backend connections in forwarding proxies until patched, forcing one request per socket.

Patch Information

Node.js maintainers coordinate fixes through the official security release channel. Consult the Node.js security release announcements and the HackerOne Report #3564941 for the specific fixed versions on the 22, 24, and 26 release lines.

Workarounds

Set maxHeadersCount and maxHeaderPairs to values large enough that framing headers cannot be pushed out of the visible collection, and reject requests that exceed a hard header cap at the edge.
Forward the raw request stream instead of reconstructing headers from req.headers, preserving the exact bytes seen by the parser.
Disable HTTP connection reuse (agent.keepAlive = false) on outbound proxy sockets to prevent cross-request contamination.

bash

# Configuration example: disable keep-alive on outbound proxy agent
const http = require('http');
const agent = new http.Agent({ keepAlive: false, maxSockets: 100 });
// Enforce strict header limits on the inbound server
const server = http.createServer({ maxHeaderSize: 16384 }, handler);
server.maxHeadersCount = 100;