CVE-2026-48932 Other in node
Node.js HTTP client flaw allows request desynchronization in proxies by hiding Content-Length headers, potentially leading to request smuggling or cache poisoning.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48932?
CVE-2026-48932 is a low-severity vulnerability in nodejs node, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Weakness: CWE-444
Which versions are affected by CVE-2026-48932?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 22.23.0, 24.17.0, 26.3.1 |
node-min Bitnami | All versions | 22.23.0, 24.17.0, 26.3.1 |
How do I fix CVE-2026-48932?
Upgrade node to a fixed version for your release line: 22.23.0, 24.17.0 or 26.3.1.
Is CVE-2026-48932 being exploited?
There is no known exploitation of CVE-2026-48932 in the wild and no public exploit code.
Sources
Also known as BIT-node-2026-48932, BIT-node-min-2026-48932, DEBIAN-CVE-2026-48932, ECHO-0130-fa3a-9541, GHSA-44cw-v76j-7fvv, MINI-2g4w-48jj-jqw6 and 8 more.