CVE-2026-58044 Other in node
Node.js HTTP client flaw allows request desynchronization in forwarding proxies by hiding Content-Length headers, potentially leading to request smuggling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58044?
CVE-2026-58044 is a low-severity vulnerability in nodejs node, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Weakness: CWE-444
Which versions are affected by CVE-2026-58044?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 22.23.2, 24.18.1, 26.5.1 |
node-min Bitnami | All versions | 22.23.2, 24.18.1, 26.5.1 |
How do I fix CVE-2026-58044?
Upgrade node to a fixed version for your release line: 22.23.2, 24.18.1 or 26.5.1.
Is CVE-2026-58044 being exploited?
There is no known exploitation of CVE-2026-58044 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2026-58044, BELL-CVE-2026-58044, BIT-node-2026-58044, BIT-node-min-2026-58044, CLEANSTART-2026-DE79594, DEBIAN-CVE-2026-58044 and 11 more.