[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-58044":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":27,"aliases":28,"duplicate_of":9,"upstream":36,"downstream":37,"duplicates":76,"related":77,"reserved_at":9,"published_at":93,"modified_at":94,"state":95,"summary":96,"references_raw":104,"kevs":135,"epss":136,"epss_history":139,"metrics":282,"affected":296},"CVE-2026-58044","A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\r\n\r\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-444","Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","The product acts as an intermediary HTTP agent\n         (such as a proxy or firewall) in the data flow between two\n         entities such as a client and server, but it does not\n         interpret malformed HTTP requests or responses in ways that\n         are consistent with how the messages will be processed by\n         those entities that are at the ultimate destination.","weakness","Incomplete","Base",[19,23],{"id":20,"name":21,"techniques":22},"CAPEC-273","HTTP Response Smuggling",[],{"id":24,"name":25,"techniques":26},"CAPEC-33","HTTP Request Smuggling",[],[],[29,30,31,32,33,34,35],"ALPINE-CVE-2026-58044","UBUNTU-CVE-2026-58044","DEBIAN-CVE-2026-58044","CGA-7rxr-97ww-3g2f","CGA-9vpp-9xwf-pvmp","CGA-cmh6-9324-c6cm","CGA-rqvx-v8gj-rh9j",[],[38,40,42,44,46,48,50,52,54,56,58,60,62,64,66,68,70,72,74],{"_key":39},"SUSE-SU-2026:3520-1",{"_key":41},"SUSE-SU-2026:3521-1",{"_key":43},"SUSE-SU-2026:3557-1",{"_key":45},"OPENSUSE-SU-2026:11439-1",{"_key":47},"OPENSUSE-SU-2026:11440-1",{"_key":49},"OPENSUSE-SU-2026:21545-1",{"_key":51},"OPENSUSE-SU-2026:21546-1",{"_key":53},"SUSE-SU-2026:23130-1",{"_key":55},"SUSE-SU-2026:23131-1",{"_key":57},"SUSE-SU-2026:23154-1",{"_key":59},"SUSE-SU-2026:23155-1",{"_key":61},"MGASA-2026-0359",{"_key":63},"RHSA-2026:48305",{"_key":65},"RHSA-2026:48537",{"_key":67},"SUSE-SU-2026:3929-1",{"_key":69},"SUSE-SU-2026:3930-1",{"_key":71},"SUSE-SU-2026:4248-1",{"_key":73},"SUSE-SU-2026:4261-1",{"_key":75},"RHSA-2026:52990",[],[78,79,80,81,82,83,84,85,86,87,88,89,90,91,92],{"_key":39},{"_key":41},{"_key":43},{"_key":45},{"_key":47},{"_key":49},{"_key":51},{"_key":53},{"_key":55},{"_key":57},{"_key":59},{"_key":67},{"_key":69},{"_key":71},{"_key":73},"2026-08-04T00:49:58.297Z","2026-08-04T15:03:46.089Z","Awaiting Analysis",{"cisa_kev":97,"cisa_ransomware":97,"cisa_vendor":9,"epss_severity":98,"epss_score":99,"severity":98,"severity_score":100,"severity_version":101,"severity_source":102,"severity_vector":103,"severity_status":95},false,"low",0.00247,3.7,"v3.0","cve.org","CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",[105,110,116,122,126,130],{"url":106,"sources":107,"tags":109},"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",[102,108],"nvd",[],{"url":111,"sources":112,"tags":114},"https://security.alpinelinux.org/vuln/CVE-2026-58044",[113],"osv_alpine",[115],"Advisory",{"url":117,"sources":118,"tags":120},"https://ubuntu.com/security/CVE-2026-58044",[119],"osv_ubuntu",[121],"REPORT",{"url":123,"sources":124,"tags":125},"https://www.cve.org/CVERecord?id=CVE-2026-58044",[119],[121],{"url":127,"sources":128,"tags":129},"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-can-enable-request-smuggling-cve-2026-58044---low",[119],[121],{"url":131,"sources":132,"tags":134},"https://security-tracker.debian.org/tracker/CVE-2026-58044",[133],"osv_debian",[115],[],{"date":137,"score":99,"percentile":138},"2026-09-19",0.16263,[140,144,147,150,153,156,160,163,166,169,172,175,178,181,184,187,190,193,196,199,202,206,209,212,215,218,221,224,227,230,233,236,239,242,245,248,251,254,257,260,263,266,269,272,275,278,281],{"date":141,"score":142,"percentile":143},"2026-08-04",0.00282,0.20464,{"date":145,"score":142,"percentile":146},"2026-08-05",0.20383,{"date":148,"score":142,"percentile":149},"2026-08-06",0.2039,{"date":151,"score":142,"percentile":152},"2026-08-07",0.20407,{"date":154,"score":142,"percentile":155},"2026-08-08",0.20409,{"date":157,"score":158,"percentile":159},"2026-08-09",0.00301,0.22425,{"date":161,"score":158,"percentile":162},"2026-08-10",0.22439,{"date":164,"score":158,"percentile":165},"2026-08-11",0.22533,{"date":167,"score":158,"percentile":168},"2026-08-12",0.22574,{"date":170,"score":158,"percentile":171},"2026-08-13",0.22599,{"date":173,"score":158,"percentile":174},"2026-08-14",0.2263,{"date":176,"score":158,"percentile":177},"2026-08-15",0.2278,{"date":179,"score":158,"percentile":180},"2026-08-16",0.22791,{"date":182,"score":158,"percentile":183},"2026-08-17",0.22698,{"date":185,"score":158,"percentile":186},"2026-08-18",0.22718,{"date":188,"score":158,"percentile":189},"2026-08-19",0.22805,{"date":191,"score":158,"percentile":192},"2026-08-20",0.22851,{"date":194,"score":158,"percentile":195},"2026-08-21",0.22886,{"date":197,"score":158,"percentile":198},"2026-08-22",0.22889,{"date":200,"score":158,"percentile":201},"2026-08-23",0.22863,{"date":203,"score":204,"percentile":205},"2026-08-24",0.00241,0.1504,{"date":207,"score":204,"percentile":208},"2026-08-25",0.15049,{"date":210,"score":204,"percentile":211},"2026-08-26",0.15101,{"date":213,"score":204,"percentile":214},"2026-08-27",0.15099,{"date":216,"score":204,"percentile":217},"2026-08-28",0.15121,{"date":219,"score":204,"percentile":220},"2026-08-29",0.15128,{"date":222,"score":204,"percentile":223},"2026-08-30",0.15143,{"date":225,"score":204,"percentile":226},"2026-08-31",0.15136,{"date":228,"score":204,"percentile":229},"2026-09-01",0.15149,{"date":231,"score":204,"percentile":232},"2026-09-02",0.15157,{"date":234,"score":204,"percentile":235},"2026-09-03",0.15162,{"date":237,"score":204,"percentile":238},"2026-09-04",0.15175,{"date":240,"score":204,"percentile":241},"2026-09-05",0.15208,{"date":243,"score":204,"percentile":244},"2026-09-06",0.15227,{"date":246,"score":204,"percentile":247},"2026-09-07",0.15219,{"date":249,"score":204,"percentile":250},"2026-09-08",0.15223,{"date":252,"score":204,"percentile":253},"2026-09-09",0.15283,{"date":255,"score":204,"percentile":256},"2026-09-10",0.15281,{"date":258,"score":204,"percentile":259},"2026-09-11",0.1529,{"date":261,"score":204,"percentile":262},"2026-09-12",0.15404,{"date":264,"score":204,"percentile":265},"2026-09-13",0.15356,{"date":267,"score":204,"percentile":268},"2026-09-14",0.15372,{"date":270,"score":204,"percentile":271},"2026-09-15",0.15433,{"date":273,"score":204,"percentile":274},"2026-09-16",0.15488,{"date":276,"score":204,"percentile":277},"2026-09-17",0.15529,{"date":279,"score":204,"percentile":280},"2026-09-18",0.15663,{"date":137,"score":99,"percentile":138},[283,288,290,292,294],{"source":102,"cvss_v2_0":9,"cvss_v3_0":284,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":100,"baseSeverity":285,"vectorString":103,"impactScore":286,"exploitabilityScore":287},"LOW",2.3,5.6,{"source":108,"cvss_v2_0":9,"cvss_v3_0":289,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":100,"baseSeverity":285,"vectorString":103,"impactScore":286,"exploitabilityScore":287},{"source":113,"cvss_v2_0":9,"cvss_v3_0":291,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":100,"baseSeverity":9,"vectorString":103,"impactScore":286,"exploitabilityScore":287},{"source":119,"cvss_v2_0":9,"cvss_v3_0":293,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":100,"baseSeverity":9,"vectorString":103,"impactScore":286,"exploitabilityScore":287},{"source":133,"cvss_v2_0":9,"cvss_v3_0":295,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":100,"baseSeverity":9,"vectorString":103,"impactScore":286,"exploitabilityScore":287},[297,314,321,325,330,333,345,352],{"ecosystem":298,"name":299,"vendor":300,"product":299,"cpe_part":9,"purl_type":301,"purl_namespace":300,"purl_name":299,"source":9,"versions":302},"Alpine Linux","nodejs","alpine","apk",[303,309,310,313],{"version":304,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":307,"version_end_type":308,"fixed_in":9},"lt22_23_2_r0",true,"ecosystem","22.23.2-r0","excluding",{"version":304,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":307,"version_end_type":308,"fixed_in":9},{"version":311,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":312,"version_end_type":308,"fixed_in":9},"lt24_18_1_r0","24.18.1-r0",{"version":311,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":312,"version_end_type":308,"fixed_in":9},{"ecosystem":315,"name":316,"vendor":317,"product":316,"cpe_part":9,"purl_type":301,"purl_namespace":317,"purl_name":316,"source":9,"versions":318},"Chainguard","nodejs-20","chainguard",[319],{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"ecosystem":315,"name":322,"vendor":317,"product":322,"cpe_part":9,"purl_type":301,"purl_namespace":317,"purl_name":322,"source":9,"versions":323},"nodejs-25",[324],{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":326,"name":316,"vendor":327,"product":316,"cpe_part":9,"purl_type":301,"purl_namespace":327,"purl_name":316,"source":9,"versions":328},"Wolfi","wolfi",[329],{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":326,"name":322,"vendor":327,"product":322,"cpe_part":9,"purl_type":301,"purl_namespace":327,"purl_name":322,"source":9,"versions":331},[332],{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":334,"name":299,"vendor":335,"product":299,"cpe_part":9,"purl_type":336,"purl_namespace":335,"purl_name":299,"source":9,"versions":337},"Debian","debian","deb",[338,339,340,341,342],{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":343,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":344,"version_end_type":308,"fixed_in":9},"lt24_19_0+dfsg+~cs24_13_3_1","24.19.0+dfsg+~cs24.13.3-1",{"ecosystem":346,"name":299,"vendor":347,"product":299,"cpe_part":9,"purl_type":336,"purl_namespace":347,"purl_name":299,"source":9,"versions":348},"Ubuntu","ubuntu",[349,350,351],{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":320,"is_range":305,"range_type":306,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":353,"vendor":299,"product":353,"cpe_part":354,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":355},"node","a",[356,360,363],{"version":357,"is_range":305,"range_type":102,"version_start":358,"version_start_type":359,"version_end":358,"version_end_type":359,"fixed_in":9},">= 26.5.0, \u003C= 26.5.0","26.5.0","including",{"version":361,"is_range":305,"range_type":102,"version_start":362,"version_start_type":359,"version_end":362,"version_end_type":359,"fixed_in":9},">= 24.18.0, \u003C= 24.18.0","24.18.0",{"version":364,"is_range":305,"range_type":102,"version_start":365,"version_start_type":359,"version_end":365,"version_end_type":359,"fixed_in":9},">= 22.23.1, \u003C= 22.23.1","22.23.1"]