This vulnerability arises from Node.js HTTP client behavior where headers beyond configured limits (maxHeadersCount / maxHeaderPairs) are omitted from user-accessible header objects (req.headers, req.rawHeaders, req.headersDistinct) but remain internally used for HTTP message framing. This discrepancy can cause request desynchronization in Node.js-based forwarding proxies that reconstruct outbound headers from visible headers while piping the original body to reused backend connections. The issue affects all supported Node.js release lines: 22, 24, and 26, including specific versions 22.23.1, 24.18.0, and 26.5.0.

The vulnerability can lead to HTTP request smuggling attacks by causing desynchronization between the headers visible to userland code and those used internally for HTTP framing. This may allow an attacker to manipulate HTTP requests in forwarding proxy scenarios, potentially leading to limited integrity impacts. The CVSS score of 3.7 reflects a low severity with no confidentiality or availability impact and requires network attack vector with high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Users should monitor Node.js vendor advisories for updates and consider limiting maxHeadersCount / maxHeaderPairs settings or avoid reusing backend connections in forwarding proxies until a fix is available.