chimurai http-proxy-middleware
4 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-55603 | >= 3.0.4, < 3.0.7 ; >= 4.0.0, < 4.1.1 | http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody` | HIGH 7.5 | 0.3 % | ||
| CVE-2026-55602 | >= 4.0.0, < 4.1.0 ; >= 3.0.0, < 3.0.6 ; >= 0.16.0, < 2.0.10 | http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass | MEDIUM 6.9 | 0.4 % | ||
| CVE-2025-32997 | < 2.0.9 ; 3.0.0 – < 3.0.5 | In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. | MEDIUM 5.3 | 0.5 % | ||
| CVE-2025-32996 | < 2.0.8 ; 3.0.0 – < 3.0.4 | In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. | MEDIUM 5.3 | 0.5 % |