Description
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.
Recommendation
Update the @sap/approuter package to the latest compatible version. Followings are version details:
- Affected version(s): < 20.10.0
- Patched version(s): 20.10.0
References
Could your website be exposed too?
SmartScanner can check your website for SAP Approuter Vulnerable to HTTP Request Smuggling and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SAP Approuter has an Information Disclosure vulnerability - CVE-2026-58230
- SAP Approuter has an Open Redirect vulnerability - CVE-2026-44745
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
- Cube Core is vulnerable to privilege escalation via a specially crafted request - CVE-2026-25958
You might also like:
See something that needs correcting? Let us knowUpdated September 01, 2026