The flaw in the Node.js HTTP client allows a request desynchronization when a forwarding proxy rebuilds outbound headers from the IncomingMessage headers while piping the body through a reused backend connection. The client may drop headers beyond the configured maximum count, but still use them internally for framing, so a header such as Content-Length can be hidden from userland while the body is still transmitted. This can cause the backend to misinterpret the message, leading to improper parsing, framing errors, or denial of service in the proxy or backend server.

Node.js v22, v24, and v26 are all affected. Any deployment that relies on the built‑in HTTP client and employs a forwarding proxy that reconstructs headers from the request object is vulnerable.

The CVSS score of 3.7 indicates moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so no known widespread exploits are reported. The attack vector is indirect, requiring the presence of a forwarding proxy that rebuilds headers from the incoming request. An attacker could potentially send crafted requests to the proxy to trigger the desynchronization, causing denial of service or unexpected behavior in the underlying backend connection.