Nodejs: A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the… (CVE-2026-58044)

The vulnerability in Node.js HTTP client arises when forwarding proxies rebuild outbound headers from the visible IncomingMessage headers while piping the original request body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount or maxHeaderPairs from user-visible header collections (req.headers, req.rawHeaders, req.headersDistinct) but still use these omitted headers internally for HTTP message framing. This discrepancy can cause request desynchronization, as critical headers such as Content-Length may be hidden from userland code but still affect the request body delivery. This issue affects all supported Node.js release lines: 22, 24, and 26.

The vulnerability can lead to request desynchronization in Node.js-based forwarding proxies, potentially causing incorrect handling of HTTP requests due to hidden headers like Content-Length. This may allow an attacker to manipulate how requests are processed by the proxy, impacting integrity but not confidentiality or availability. The CVSS score of 3.7 reflects a medium impact with low confidentiality impact, limited integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Node.js vendor advisories for updates addressing this issue. Until a fix is available, avoid relying on Node.js-based forwarding proxies that rebuild outbound headers from IncomingMessage headers while reusing backend connections, or implement additional validation to detect header inconsistencies.