Homepage

HTTP Request Smuggling The advisory has been revoked - it doesn't affect any version of package nodejs24-full-i18n  (opens in a new tab)

Threat Intelligence

EPSS
0.27% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-NODEJS24FULLI18N-18609300
  • published11 Aug 2026
  • disclosed4 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 4 Aug 2026

CVE-2026-58044  (opens in a new tab)
CWE-444  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs24-full-i18n package and not the nodejs24-full-i18n package as distributed by RHEL.

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.

Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.