Description
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP_SE | SAP Approuter | SAP Approuter node.js package < 20.10.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @sap/approuter | < 20.10.0 | 20.10.0 | GHSA-8m85-wqg7-c529 |
Advisories 2
- WID-SEC-2026-2308 SAP Patch Day Juli 2026 BSI CERT-Bund (WID) · Jul 28, 2026
- NCSC-2026-0230 Kwetsbaarheden verholpen in SAP-producten NCSC-NL (Netherlands) · Jul 17, 2026