Skip to main content
cve.nowby Sazabi
← npm
npmPackage

http-proxy-middleware

5 known vulnerabilities (2 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
4.2.1 (Oct 24, 2026): no advisory affects it
Newest unaffected release
4.2.1 (Oct 24, 2026), the latest release
Advisories
5 · 2 high, 3 medium
Weekly downloads
32.4M
Dependents
527
Releases
111 since 0.0.1 (Mar 14, 2015)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-55603
    Affects 3.0.4 to 3.0.6 (3.0.7 is outside it); 4.0.0 to 4.1.0 (4.1.1 is outside it)
  • CVE-2026-55602
    Affects 0.16.0 to 2.0.10-beta.0 (2.0.10 is outside it); 3.0.0 to 3.0.5 (3.0.6 is outside it); 4.0.0 to 4.1.0-beta.2 (4.1.0 is outside it)
  • CVE-2025-32997
    Affects 1.3.0 to 2.0.8 (2.0.9 is outside it); 3.0.0 to 3.0.4 (3.0.5 is outside it)
  • CVE-2025-32996
    Affects 1.3.0 to 2.0.7 (2.0.8 is outside it); 3.0.0 to 3.0.3 (3.0.4 is outside it)
  • CVE-2024-21536
    Affects 0.0.1 to 2.0.7-beta.1 (2.0.7 is outside it); 3.0.0 to 3.0.2 (3.0.3 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

    Affected: from 3.0.4, fixed in 3.0.7; from 4.0.0, fixed in 4.1.1.

    Fixed in 3.0.7 (released Jun 14, 2026, 8 days before disclosure) and 4.1.1 (released Jun 14, 2026, 8 days before disclosure).

    The latest release, 4.2.1, is not affected.

    11% of http-proxy-middleware downloads last week were affected versions (4.1M).

  • CVE-2026-55602Medium 6.9

    http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass

    Affected: from 3.0.0, fixed in 3.0.6; from 4.0.0, fixed in 4.1.0; from 0.16.0, fixed in 2.0.10.

    Fixed in 2.0.10 (released Jun 19, 2026, 3 days before disclosure), 3.0.6 (released Jun 6, 2026, 16 days before disclosure) and 4.1.0 (released Jun 6, 2026, 16 days before disclosure).

    The latest release, 4.2.1, is not affected.

    59% of http-proxy-middleware downloads last week were affected versions (22.1M).

  • CVE-2025-32997Medium 4.0

    In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

    Affected: from 1.3.0, fixed in 2.0.9; from 3.0.0, fixed in 3.0.5.

    Fixed in 2.0.9 (released Apr 10, 2025, 5 days before disclosure) and 3.0.5 (released Apr 10, 2025, 5 days before disclosure).

    The latest release, 4.2.1, is not affected.

    16% of http-proxy-middleware downloads last week were affected versions (6.1M).

  • CVE-2025-32996Medium 4.0

    In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.

    Affected: from 1.3.0, fixed in 2.0.8; from 3.0.0, fixed in 3.0.4.

    Fixed in 2.0.8 (released Apr 9, 2025, 6 days before disclosure) and 3.0.4 (released Apr 9, 2025, 6 days before disclosure).

    The latest release, 4.2.1, is not affected.

    16% of http-proxy-middleware downloads last week were affected versions (5.9M).

  • Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to…

    Affected: fixed in 2.0.7; from 3.0.0, fixed in 3.0.3.

    Fixed in 2.0.7 (released Oct 6, 2024, 13 days before disclosure) and 3.0.3 (released Oct 6, 2024, 13 days before disclosure).

    The latest release, 4.2.1, is not affected.

    19% of http-proxy-middleware downloads last week were affected versions (7.1M).