TI-2026-40137 CVE-2026-55603 · GHSA-gcq2-9pq2-cxqm
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
Priority HIGH 66
http-proxy-middleware is node.js http-proxy middleware.
Vulnerabilities
5 records
TI-2026-40136 CVE-2026-55602 · GHSA-64mm-vxmg-q3vj
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
Priority HIGH 70
http-proxy-middleware is node.js http-proxy middleware.
TI-2025-24005 CVE-2025-32997 · GHSA-9gqv-wp59-fq42
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
Priority LOW 24
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
TI-2025-24004 CVE-2025-32996 · GHSA-4www-5p9h-95mh
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
Priority LOW 24
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
TI-2024-14292 CVE-2024-21536 · GHSA-c7qv-q95q-8v27
Uncontrolled resource consumption in http-proxy-middleware
Priority HIGH 77
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch.