chimurai http-proxy-middleware vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 20262

Newest CVEs

• CVE-2026-55603

  http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

  chimurai · http-proxy-middleware

  High7.5
• CVE-2026-55602

  http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass

  chimurai · http-proxy-middleware

  Medium6.9
• CVE-2025-32997

  In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

  chimurai · http-proxy-middleware

  Medium4.0
• CVE-2025-32996

  In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.

  chimurai · http-proxy-middleware

  Medium4.0