5vulnerabilities
- Critical0 (0.0%)
- High2 (40.0%)
- Medium0 (0.0%)
- Moderate3 (60.0%)
- Low0 (0.0%)
http-proxy-middleware
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 4 versions
- 0MediumAffects 0 versions
- 3ModerateAffects 7 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 2 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 1
- Low: 0
- 2 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 2
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (5)
Known vulnerabilities affecting http-proxy-middleware, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-64mm-vxmg-q3vj | Moderate | http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass# Summary `http-proxy-middleware` documents `router` proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted `Host` header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. # Details Tested code state: - validated on tag `v4.0.0-beta.5` - corresponding commit: `339f09ede860197807d4fd99ed9020fa5d0bd358` Relevant code locations: - `src/router.ts` - `src/http-proxy-middleware.ts` Affected pub |
| GitHub (opens in a new tab) | |
| GHSA-gcq2-9pq2-cxqm | High | http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`## Summary `fixRequestBody()` is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the **outgoing** `Content-Type` is `multipart/form-data`, it rebuilds the body with `handlerFormDataBodyData()`, which interpolates each `req.body` key and value directly into the multipart wire format **without neutralizing CR/LF**: ```js // dist/handlers/fix-request-body.js function handlerFormDataBodyData(contentType, data) { const boundary = contentType.replace(/^.*boundary=(.*)$/, '$1'); let str = ''; for (const [key, value] of Object.entr |
| GitHub (opens in a new tab) | |
| GHSA-4www-5p9h-95mh | Moderate | http-proxy-middleware can call writeBody twice because "else if" is not usedIn http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. |
| GitHub (opens in a new tab) | |
| GHSA-9gqv-wp59-fq42 | Moderate | http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failedIn http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. |
| GitHub (opens in a new tab) | |
| GHSA-c7qv-q95q-8v27 | High | Denial of service in http-proxy-middlewareVersions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths. |
| GitHub (opens in a new tab) |
- GHSA-64mm-vxmg-q3vjModeratehttp-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
>= 3.0.0, < 3.0.6>= 4.0.0, < 4.1.0- +1 more
Affected versions:>= 3.0.0, < 3.0.6>= 4.0.0, < 4.1.0>= 0.16.0, < 2.0.10
# Summary `http-proxy-middleware` documents `router` proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted `Host` header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. # Details Tested code state: - validated on tag `v4.0.0-beta.5` - corresponding commit: `339f09ede860197807d4fd99ed9020fa5d0bd358` Relevant code locations: - `src/router.ts` - `src/http-proxy-middleware.ts` Affected pub
CVE: CVE-2026-55602
- GHSA-gcq2-9pq2-cxqmHighhttp-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
>= 3.0.4, < 3.0.7>= 4.0.0, < 4.1.1
## Summary `fixRequestBody()` is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the **outgoing** `Content-Type` is `multipart/form-data`, it rebuilds the body with `handlerFormDataBodyData()`, which interpolates each `req.body` key and value directly into the multipart wire format **without neutralizing CR/LF**: ```js // dist/handlers/fix-request-body.js function handlerFormDataBodyData(contentType, data) { const boundary = contentType.replace(/^.*boundary=(.*)$/, '$1'); let str = ''; for (const [key, value] of Object.entr
CVE: CVE-2026-55603
- GHSA-4www-5p9h-95mhModeratehttp-proxy-middleware can call writeBody twice because "else if" is not used
>= 1.3.0, < 2.0.8>= 3.0.0, < 3.0.4
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
CVE: CVE-2025-32996
- GHSA-9gqv-wp59-fq42Moderatehttp-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
>= 1.3.0, < 2.0.9>= 3.0.0, < 3.0.5
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
CVE: CVE-2025-32997
- GHSA-c7qv-q95q-8v27HighDenial of service in http-proxy-middleware
< 2.0.7>= 3.0.0, < 3.0.3
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
CVE: CVE-2024-21536