CVE-2026-27690
CVE-2026-27690 · HTTP Request Smuggling in SAP Approuter
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.
CVSS 9.1 · Critical · EPSS 0.7% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
sap approuter
- Versions
- SAP Approuter node.js package < 20.10.0: Affected
No fix published
@sap/approuter npm
- Affected ranges
- SEMVER: < 20.10.0
Update to 20.10.0