SAP Approuter HTTP Request Smuggling Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- @sap/approuter (npm)
- Affected versions
- >= 2.6.1, < 16.7.2
- Patched version
- Not yet available
An HTTP Request Smuggling vulnerability has been reported in SAP Approuter. This vulnerability could allow an unauthenticated attacker to desynchronize request-response pairs, potentially exposing user responses and causing system unavailability.
What happened
SAP Approuter is reportedly vulnerable to an HTTP Request Smuggling attack. This vulnerability, tracked as GHSA-8M85-WQG7-C529 and CVE-2026-27690, allows an unauthenticated attacker to send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. The affected versions of @sap/approuter (npm) are those greater than or equal to 2.6.1 and less than 16.7.2.
The vulnerability was first flagged on July 14, 2026. It is currently under investigation and has not been exploited in the wild. The primary source indicates that versions less than 20.10.0 are affected, with 20.10.0 being the patched version.
What to do about it
- Monitor the official sources for updates on the vulnerability.
- Upgrade to version 20.10.0 of @sap/approuter (npm) once it is available.
- Continue to monitor for any patches or updates from SAP regarding this vulnerability.
- Implement additional security measures to mitigate the risk of HTTP Request Smuggling attacks.
How 0Day would have caught this
@sap/approuter is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using @sap/approuter (npm) in versions greater than or equal to 2.6.1 and less than 16.7.2.
What should I do right now?
Monitor for patches and upgrade to version 20.10.0 of @sap/approuter (npm) once it is available.
Is there a patched version available?
Yes, version 20.10.0 of @sap/approuter (npm) is the patched version.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild according to the current information.