Desynchronization Flaw in Node.js HTTP Client Impacting Multiple Versions

CVE-2026-58044

What is CVE-2026-58044?

A vulnerability in the Node.js HTTP client allows for request desynchronization in Node.js-based forwarding proxies. Due to the way HTTP headers are managed, there are instances where certain headers, such as Content-Length, can be omitted from the publicly visible headers while still being utilized internally for message framing. This flaw occurs when proxies rebuild outbound headers based on visible IncomingMessage headers while the original body is being sent to a reused backend connection. This oversight can lead to unexpected behaviors and security implications for applications relying on Node.js for HTTP communications.

References