Skip to content
OpenAdvisories

Package · npm

http-proxy-middleware

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-55602

    http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass

    http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring ma…

    chimurai http-proxy-middleware http-proxy-middleware npm
  • Medium 4.0
    CVE-2025-32997

    http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

    In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

    chimurai http-proxy-middleware http-proxy-middleware npm
  • Medium 4.0
    CVE-2025-32996

    http-proxy-middleware can call writeBody twice because "else if" is not used

    In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.

    chimurai http-proxy-middleware http-proxy-middleware npm