Vulnerability-Lookup

CVE-2026-58044 (GCVE-0-2026-58044)

Vulnerability from cvelistv5 – Published: 2026-08-04 00:49 – Updated: 2026-08-04 15:03

Summary

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Severity

3.7 (Low)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 14:19 UTC

CWE

CWE-444 - HTTP Request Smuggling

Assigner

hackerone mitre root

References

1 reference

URL	Tags
https://nodejs.org/en/blog/vulnerability/july-202…

Impacted products

1 product

Vendor	Product	Version	CPE status
nodejs	node	Affected: 26.5.0 , ≤ 26.5.0 (semver) Affected: 24.18.0 , ≤ 24.18.0 (semver) Affected: 22.23.1 , ≤ 22.23.1 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58044",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T14:19:38.226326Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T15:03:46.089Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "26.5.0",
              "status": "affected",
              "version": "26.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\r\n\r\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444 HTTP Request Smuggling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T00:49:58.297Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-58044",
    "datePublished": "2026-08-04T00:49:58.297Z",
    "dateReserved": "2026-06-27T15:00:00.780Z",
    "dateUpdated": "2026-08-04T15:03:46.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-58044",
      "date": "2026-09-16",
      "epss": "0.00241",
      "percentile": "0.15488"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-58044\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2026-08-04T01:16:20.247\",\"lastModified\":\"2026-09-03T17:02:54.670\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\\r\\n\\r\\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\\r\\n\\r\\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.\"}],\"affected\":[{\"source\":\"support@hackerone.com\",\"affectedData\":[{\"vendor\":\"nodejs\",\"product\":\"node\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"26.5.0\",\"lessThanOrEqual\":\"26.5.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"24.18.0\",\"lessThanOrEqual\":\"24.18.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"22.23.1\",\"lessThanOrEqual\":\"22.23.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-04T14:19:38.226326Z\",\"id\":\"CVE-2026-58044\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]}],\"references\":[{\"url\":\"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases\",\"source\":\"support@hackerone.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-11T15:31:55+00:00",
      "cve": "CVE-2026-58044",
      "id": "CVE-2026-58044",
      "initial_release_date": "2026-08-04T00:49:58.297000+00:00",
      "product_status:fixed": "12",
      "product_status:known_affected": "60",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "nodejs: Node.js: Request smuggling via HTTP client header truncation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58044.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:06:43Z",
      "cve": "CVE-2026-58044",
      "id": "CVE-2026-58044",
      "initial_release_date": "2026-07-30T16:37:17Z",
      "product_status:known_affected": "226",
      "product_status:recommended": "95",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-58044",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-58044.json",
      "version": "14"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-58044\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-04T14:19:38.226326Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-04T14:19:39.215Z\"}}], \"cna\": {\"metrics\": [{\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 3.7, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"nodejs\", \"product\": \"node\", \"versions\": [{\"status\": \"affected\", \"version\": \"26.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"26.5.0\"}, {\"status\": \"affected\", \"version\": \"24.18.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"24.18.0\"}, {\"status\": \"affected\", \"version\": \"22.23.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"22.23.1\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\\r\\n\\r\\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\\r\\n\\r\\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-444\", \"description\": \"CWE-444 HTTP Request Smuggling\"}]}], \"providerMetadata\": {\"orgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"shortName\": \"hackerone\", \"dateUpdated\": \"2026-08-04T00:49:58.297Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-58044\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-04T15:03:46.089Z\", \"dateReserved\": \"2026-06-27T15:00:00.780Z\", \"assignerOrgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"datePublished\": \"2026-08-04T00:49:58.297Z\", \"assignerShortName\": \"hackerone\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-node-2026-58044

Vulnerability from bitnami_vulndb

Published

2026-08-17 05:52

Modified

2026-08-17 06:10

Summary

Details

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.

Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "node",
        "purl": "pkg:bitnami/node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "22.23.2"
            },
            {
              "introduced": "23.0.0"
            },
            {
              "fixed": "24.18.1"
            },
            {
              "introduced": "25.0.0"
            },
            {
              "fixed": "26.5.1"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58044"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"
    ],
    "severity": "Low"
  },
  "details": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\r\n\r\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
  "id": "BIT-node-2026-58044",
  "modified": "2026-08-17T06:10:32.268Z",
  "published": "2026-08-17T05:52:35.230Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58044"
    }
  ],
  "schema_version": "1.6.2"
}

CERTFR-2026-AVI-0947

Vulnerability from certfr_avis - Published: 2026-07-30 - Updated: 2026-07-30

De multiples vulnérabilités ont été découvertes dans Node.js. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Node.js	Node.js	Node.js versions 26.x antérieures à 26.5.1
Node.js	Node.js	Node.js versions 24.x antérieures à 24.18.1
Node.js	Node.js	Node.js versions 22.x antérieures à 22.23.2

References

Title

Publication Time

FKIE_CVE-2026-58044

Vulnerability from fkie_nvd - Published: 2026-08-04 01:16 - Updated: 2026-09-03 17:02

Severity

3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	support@hackerone.com	https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThanOrEqual": "26.5.0",
              "status": "affected",
              "version": "26.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.18.0",
              "status": "affected",
              "version": "24.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.23.1",
              "status": "affected",
              "version": "22.23.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "support@hackerone.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\r\n\r\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
    }
  ],
  "id": "CVE-2026-58044",
  "lastModified": "2026-09-03T17:02:54.670",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "support@hackerone.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-58044",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-04T14:19:38.226326Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-04T01:16:20.247",
  "references": [
    {
      "source": "support@hackerone.com",
      "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6HFF-9F4H-85XM

Vulnerability from github – Published: 2026-08-04 03:31 – Updated: 2026-08-04 03:31

Details

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

Severity

3.7 (Low)


                  
                    CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-58044"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-04T01:16:20Z",
    "severity": "LOW"
  },
  "details": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\n\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
  "id": "GHSA-6hff-9f4h-85xm",
  "modified": "2026-08-04T03:31:10Z",
  "published": "2026-08-04T03:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58044"
    },
    {
      "type": "WEB",
      "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

RHSA-2026:48305

Vulnerability from csaf_redhat - Published: 2026-07-29 22:50 - Updated: 2026-09-08 05:22

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

10 vulnerabilities in this advisory, including CVE-2026-58044.

CVE-2026-58044

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application while still using them internally for message processing. This inconsistency can allow an attacker to bypass security controls and inject malicious requests, impacting the integrity of network communications.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 4 products

https://access.redhat.com/errata/RHSA-2026:48305

Open the full advisory

RHSA-2026:48537

Vulnerability from csaf_redhat - Published: 2026-07-30 03:14 - Updated: 2026-09-08 05:44

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

15 vulnerabilities in this advisory, including CVE-2026-58044.

CVE-2026-58044

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 4 products

https://access.redhat.com/errata/RHSA-2026:48537

Open the full advisory

RHSA-2026:52990

Vulnerability from csaf_redhat - Published: 2026-08-10 19:08 - Updated: 2026-09-10 23:41

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Scope

5 vulnerabilities in this advisory, including CVE-2026-58044.

CVE-2026-58044

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 4 products

https://access.redhat.com/errata/RHSA-2026:52990

Open the full advisory

SUSE-SU-2026:3521-1

Vulnerability from csaf_suse - Published: 2026-08-06 11:31 - Updated: 2026-08-06 11:31

Summary

Security update for nodejs22

Severity

Important

Scope

11 vulnerabilities in this advisory, including CVE-2026-58044.

CVE-2026-58044

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Recommended: 33 products

Open the full advisory

SUSE-SU-2026:3929-1

Vulnerability from csaf_suse - Published: 2026-09-03 07:18 - Updated: 2026-09-16 09:04

Summary

Security update for nodejs20

Severity

Important

Scope

35 vulnerabilities in this advisory, including CVE-2026-58044.

CVE-2026-58044

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Recommended: 39 products

Open the full advisory

SUSE-SU-2026:3930-1

Vulnerability from csaf_suse - Published: 2026-09-03 07:19 - Updated: 2026-09-16 09:04

Summary

Security update for nodejs20

Severity

Important

Scope

35 vulnerabilities in this advisory, including CVE-2026-58044.

CVE-2026-58044

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Recommended: 60 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-58044 (GCVE-0-2026-58044)

Vulnerability from bitnami_vulndb

Solutions

Tags

Sightings

Nomenclature

Related by attack behaviour