BIT-NODE-MIN-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

BIT-NODE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

K000162941: NodeJS vulnerability CVE-2026-58044

Security Advisory Description A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers...

PT-2026-73402

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-73412

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481

The Gitea Git repository management system contains a flaw where the internal API HTTP client hardcodes InsecureSkipVerify:true in the init-function of the internalAPITransport function (located in modules/private/internal.go). This lack of TLS certificate verification allows a remote attacker on...

EUVD-2026-58137

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481: Improper Certificate Validation

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

Alibaba Cloud Linux 3 : 0255: resource-agents (ALINUX3-SA-2026:0255)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0255 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-44431: urllib3 is an HTTP client library f...

nodejs: Node.js HTTP client: Request desynchronization due to omitted headers

A flaw was found in the Node.js HTTP client. This vulnerability can cause a request desynchronization in Node.js-based forwarding proxies. A remote attacker could exploit this by sending crafted HTTP requests where the Node.js client omits certain headers from being visible to the proxy, while...

vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects

A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a...

nodejs: Node.js HTTP client: Request desynchronization due to omitted headers

A flaw was found in the Node.js HTTP client. This vulnerability can cause a request desynchronization in Node.js-based forwarding proxies. A remote attacker could exploit this by sending crafted HTTP requests where the Node.js client omits certain headers from being visible to the proxy, while...

CLSA-2026-1786546010 TuxCare security update for guzzlehttp/guzzle (2 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 7.10.0-p3+tuxcare...

nodejs: Node.js HTTP client: Request desynchronization due to omitted headers

A flaw was found in the Node.js HTTP client. This vulnerability can cause a request desynchronization in Node.js-based forwarding proxies. A remote attacker could exploit this by sending crafted HTTP requests where the Node.js client omits certain headers from being visible to the proxy, while...

EUVD-2026-56219

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...

CLSA-2026-1786439704 TuxCare security update for guzzlehttp/guzzle (6 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 6 CVEs. Fixed in 6.3.3-p2+tuxcare...

nodejs: Node.js: Request smuggling via HTTP client header truncation

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...