A flaw in Node.js’s HTTP client allows an outbound request to be built from the visible IncomingMessage headers while the original body is piped to a reused backend connection. Because the client can drop header fields that exceed the configured maxHeadersCount or maxHeaderPairs yet still use those omitted headers for HTTP framing, fields such as Content‑Length may be hidden from the application layer. The result is a misalignment between the declared body length and the actual data transmitted, which can lead to corrupted or incomplete request handling.

All active Node.js release lines, specifically Node.js 22, 24, and 26, are affected. Any deployment of the node:node product that employs the HTTP client for proxy forwarding or similar request piping scenarios is vulnerable.

The CVSS score of 4.8 signals a low overall severity; EPSS score indicates a very low exploitation probability (< 1%) and the vulnerability is not listed in the CISA KEV catalog. The impact is restricted to integrity and correctness of forwarded requests, without evidence of code execution or data leakage. Because the description does not describe a direct exploitation route beyond header omission, the risk to attackers appears limited to potential request‑handling errors. Nevertheless, applying a patch when it becomes available remains the best defensive measure.