CVE-2026-58044: Node.js HTTP Desync Vulnerability

CVE-2026-58044 Overview

CVE-2026-58044 is an HTTP Request Smuggling vulnerability [CWE-444] in the Node.js HTTP client. The flaw causes request desynchronization in Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount or maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. The vulnerability affects all supported release lines, including Node.js 22, Node.js 24, and Node.js 26.

Critical Impact
Attackers can hide a Content-Length header from userland proxy code while the request body is still delivered, enabling request smuggling against backend services.

Affected Products

Node.js 22 (all supported releases prior to patch)
Node.js 24 (all supported releases prior to patch)
Node.js 26 (all supported releases prior to patch)

Discovery Timeline

2026-08-04 - CVE CVE-2026-58044 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-58044

Vulnerability Analysis

The vulnerability creates a desynchronization between what userland code sees and what the Node.js HTTP parser uses for message framing. When an HTTP request contains more headers than the configured maxHeadersCount or maxHeaderPairs limit, Node.js truncates the excess headers from the JavaScript-visible request object. The parser, however, still uses those hidden headers internally to determine message boundaries.

Forwarding proxies built on Node.js typically read req.headers to construct outbound requests, then pipe the raw body stream to a backend socket. Because a hidden Content-Length still governs body length internally, the proxy can forward a body of a size that disagrees with the outbound headers it rebuilds. Attackers exploit this gap to smuggle a second request onto a reused backend connection.

Root Cause

The root cause is inconsistent header visibility between the HTTP parser and the userland API. The parser enforces limits by hiding overflow headers from req.headers, req.rawHeaders, and req.headersDistinct while continuing to honor them for framing decisions. This violates the assumption that visible headers represent the authoritative message structure.

Attack Vector

Exploitation requires an attacker to send crafted HTTP requests through a Node.js forwarding proxy that rebuilds headers and pipes bodies to pooled backend connections. The attacker inflates the header count past maxHeadersCount or maxHeaderPairs so that a Content-Length header falls beyond the visible set. The proxy then forwards a request whose declared length does not match the piped body, poisoning the reused backend connection with a smuggled request. Refer to the Node.js July 2026 Security Blog for framing details.

Detection Methods for CVE-2026-58044

Indicators of Compromise

HTTP requests containing an unusually high header count that exceeds default maxHeadersCount (2000) or maxHeaderPairs limits.
Backend access logs showing request/response pairing anomalies or requests attributed to unexpected clients on pooled upstream connections.
Duplicate or conflicting Content-Length headers observed at the network edge but absent from proxy application logs.

Detection Strategies

Inspect raw HTTP frames at the perimeter and compare header counts against what the proxy application logs as forwarded.
Alert on divergence between edge-observed request bodies and backend-declared Content-Length values.
Instrument Node.js proxies to log req.rawHeaders.length alongside the socket-level bytes read for each request.

Monitoring Recommendations

Monitor upstream connection reuse patterns for requests that appear to change identity mid-connection.
Track 400-class responses from backends that correlate with high header-count inbound traffic.
Feed proxy and backend HTTP telemetry into a centralized analytics platform to correlate smuggling indicators across tiers.

How to Mitigate CVE-2026-58044

Immediate Actions Required

Upgrade Node.js to the patched releases published in the July 2026 security release for the 22, 24, and 26 lines.
Audit forwarding proxy code that rebuilds outbound headers from req.headers and pipes req bodies to reused backend sockets.
Reject inbound requests whose header count approaches maxHeadersCount or maxHeaderPairs at an upstream reverse proxy.

Patch Information

The Node.js project addressed the flaw in the July 2026 security releases across the 22, 24, and 26 release lines. Review the Node.js July 2026 Security Blog for the exact patched versions and download links.

Workarounds

Disable HTTP connection reuse (keep-alive) on the outbound side of Node.js forwarding proxies until patched.
Terminate and re-establish backend connections after every proxied request to prevent smuggled follow-on requests.
Enforce strict header-count limits at an upstream layer such as a reverse proxy or WAF before traffic reaches Node.js.

bash

# Example: enforce lower header limits and disable keep-alive to backend
node --max-http-header-size=16384 proxy.js

# In proxy code, avoid pooled agents when rebuilding headers:
# const agent = new http.Agent({ keepAlive: false, maxSockets: Infinity });