Request Desynchronization in Node.js HTTP Client for Node.js Proxies

CVE-2026-48932

What is CVE-2026-48932?

A flaw in the Node.js HTTP client leads to potential request desynchronization issues for Node.js-based forwarding proxies. This occurs when proxies attempt to rebuild outbound headers from the visible 'IncomingMessage' headers while inadvertently piping the original request body to a reused backend connection. The Node.js platform may omit certain headers, such as 'Content-Length', beyond specified limits, while still utilizing these omitted headers internally, which can create discrepancies in HTTP message framing and result in unintended data exposure. This vulnerability is present across all supported release lines of Node.js, including versions 22, 24, and 26.

References