Read the docs
TI-2026-40137 Aliases CVE-2026-55603GHSA-gcq2-9pq2-cxqm

http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

Priority HIGH 66CWE-93Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · High · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \r\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00286 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial http-proxy-middleware (chimurai): 3.0.7, 4.1.1http-proxy-middleware (npm): 3.0.7, 4.1.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chimuraihttp-proxy-middleware3.0.4 to before 3.0.7; 4.0.0 to before 4.1.13.0.7, 4.1.1Patch availableCNA
—http-proxy-middleware (npm)3.0.4 to before 3.0.73.0.7Patch availableGHSA-gcq2-9pq2-cxqm
—http-proxy-middleware (npm)4.0.0 to before 4.1.14.1.1Patch availableGHSA-gcq2-9pq2-cxqm
  • http-proxy-middleware Vendorchimurai Affected 3.0.4 to before 3.0.7; 4.0.0 to before 4.1.1 Fixed in 3.0.7, 4.1.1 Patch available CNA
  • http-proxy-middleware (npm) Vendor— Affected 3.0.4 to before 3.0.7 Fixed in 3.0.7 Patch available GHSA-gcq2-9pq2-cxqm
  • http-proxy-middleware (npm) Vendor— Affected 4.0.0 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-gcq2-9pq2-cxqm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*3.0.4 to before 3.0.7; 4.0.0 to before 4.1.1Vulnerablechimurai
  • cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:* Versions 3.0.4 to before 3.0.7; 4.0.0 to before 4.1.1 Vulnerable ·chimurai

Remediation

  • Fix · CNA http-proxy-middleware (chimurai) Fixed in 3.0.7, 4.1.1
  • Fix · GHSA-gcq2-9pq2-cxqm http-proxy-middleware (npm) Fixed in 3.0.7 Advisory →
  • Fix · GHSA-gcq2-9pq2-cxqm http-proxy-middleware (npm) Fixed in 4.1.1 Advisory →

Red Hat 2 advisories

  • RHSA-2026:50300 Released 2026-08-04 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
  • RHSA-2026:42085 Released 2026-07-20 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-ui-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Trusted Profile AnalyzerAffectedNo fix yet
Red Hat Migration Toolkit for Applications 8.1Fixed RHSA-2026:50300
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:42085
Not affected: 30 products
  • Cryostat 4
  • Gatekeeper 3
  • Migration Toolkit for Applications 8
  • Migration Toolkit for Containers
  • Node HealthCheck Operator
  • OpenShift Lightspeed
  • OpenShift Pipelines
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Podman Desktop
  • Red Hat Connectivity Link 1
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Fuse 7
  • Red Hat Migration Toolkit for Applications 8.1
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Virtualization 4
  • Red Hat Quay 3
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apache Camel for Spring Boot 4
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55603
  2. 2026-10-03 Alias added: GHSA-gcq2-9pq2-cxqm
  3. 2026-10-27 Affected versions changed · Red Hat
  4. 2026-10-30 Affected versions changed · Red Hat

References

Exploit 1

Other 1

  • TI-2024-14292 Uncontrolled resource consumption in http-proxy-middleware CVSS 4.0HIGH 8.7
  • TI-2026-40136 http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass CVSS 4.0MEDIUM 6.9
  • TI-2025-24005 In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. CVSS 3.1MEDIUM 5.3
  • TI-2025-24004 In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences