{
  "cve": [
    "CVE-2026-58044"
  ],
  "vulnerable": "22.x || 24.x || 26.x",
  "patched": "^22.23.2 || ^24.18.1 || ^26.5.1",
  "ref": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
  "description": "HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser",
  "overview": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\n\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
  "affectedEnvironments": [
    "all"
  ],
  "severity": "low"
}