A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-74848 is a high-severity vulnerability in Apache APISIX affecting versions from 2.12.0 through 3.17.0. It involves inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, which can cause clients to receive responses intended for other users on serverless-plugin routes. The issue is fixed in version 3.18.0.
CVE-2026-75922 is a medium severity vulnerability in Reverse::Proxy for Perl versions before 0.04 that allows HTTP request smuggling. The issue arises because the proxy percent-decodes PATH_INFO before forwarding it upstream without re-encoding, enabling an attacker to inject CRLF sequences that split the request line. This causes the upstream server to interpret additional attacker-controlled requests on a reused keep-alive connection, potentially bypassing proxy routing restrictions.
CVE-2026-63385 is a critical vulnerability in libevent's HTTP parsing code affecting versions prior to 2.1.13 and 2.2.2-alpha. It involves two weaknesses: one where percent-encoded %00 bytes are decoded into literal NUL characters, potentially truncating paths and bypassing validation, and another where obsolete line folding in HTTP header values is accepted, enabling header injection or access control bypass. The header folding issue is fixed in versions 2.1.13 and 2.2.2-alpha, but the NUL truncation issue is not clearly remediated by the patches.
CVE-2026-63379 is a vulnerability in libevent prior to versions 2.1.13 and 2.2.2-alpha where chunked HTTP trailers are improperly merged into request headers. This allows an unauthenticated remote attacker to exploit HTTP request/response smuggling by placing sensitive headers in trailers, potentially causing authorization bypass, proxy-header spoofing, or cache poisoning. The issue is fixed by parsing trailers into a temporary list and discarding them instead of merging them.
CVE-2026-63382 is a critical HTTP request/response smuggling vulnerability in libevent's evhttp parser affecting versions prior to 2.1.13 and 2.2.2-alpha. The flaw arises from inconsistent handling of duplicate and comma-separated Transfer-Encoding headers and improper parsing of chunked framing with bare line feeds. This can allow an unauthenticated remote attacker to desynchronize request boundaries when libevent is behind a proxy, potentially bypassing access controls or poisoning caches. The issue is fixed in libevent versions 2.1.13 and 2.2.2-alpha.
Mongoose, an embedded web server and network library, has a critical HTTP request smuggling vulnerability (CVE-2026-73256) affecting versions prior to 7.22. The flaw arises from inconsistent handling of HTTP/1.0 requests with Transfer-Encoding: chunked headers, allowing remote unauthenticated attackers to bypass proxy protections. This can lead to unauthorized access or state changes. The issue is fixed in version 7.22.
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
Etherpad versions from 2.1.0 up to but not including 3.1.0 are vulnerable to a cross-site scripting (XSS) issue via the x-proxy-path HTTP header. This header is used without proper sanitization in the admin interface, allowing an attacker to inject scripts that may be cached and served to administrators. Additionally, version 3.0.0 allows an open redirect via the same header in the timeslider feature. These vulnerabilities require that client-supplied x-proxy-path headers reach the Etherpad server. The issues are fixed in version 3.1.0.
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-72587 is a medium severity cache poisoning vulnerability in CoreBunch's Instatic product versions prior to 0.0.15. It allows an unauthenticated remote attacker to manipulate the shared process-wide render cache by exploiting the u query parameter in a specific GET request endpoint. This vulnerability is related to inconsistent interpretation of HTTP requests, categorized under CWE-444 (HTTP Request/Response Smuggling). No official patch or remediation guidance has been provided yet.
python-hyper h2 versions up to and including 4.4.0 have a vulnerability where HTTP/2 request header blocks containing multiple Host headers are accepted and forwarded to the application. When the consumer downgrades HTTP/2 to HTTP/1.1, this results in two Host header lines in the HTTP/1.1 request, enabling HTTP request smuggling. This issue is resolved in version 4.4.1.
CVE-2026-9190 is an HTTP request smuggling vulnerability in the HTTP App Server component of Progress MarkLogic Server versions 11.0.0 and 12.0.0. This flaw allows a remote attacker to bypass authentication and authorization controls, hijack user sessions, or capture credentials by exploiting inconsistent interpretation of HTTP request boundaries between a reverse proxy and the server when both Content-Length and Transfer-Encoding headers are present in a crafted request.
CVE-2026-58044 is a low severity vulnerability in Node.js HTTP client affecting supported release lines 22, 24, and 26. It involves HTTP request smuggling due to request desynchronization in forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections. The flaw allows certain headers, including Content-Length, to be omitted from userland header objects but still used internally for HTTP framing, potentially causing inconsistencies.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Apache Traffic Server versions 10.0.0 through 10.1.3 have a vulnerability where HTTP/2 origin trailers are forwarded to HTTP/1 clients without proper chunked framing during protocol conversion. This inconsistent interpretation of HTTP requests can lead to impacts on confidentiality, integrity, and availability. Upgrading to versions 9.2.15 or 10.1.4 resolves this issue.