# http-proxy-middleware (npm) vulnerabilities 5 known vulnerabilities (2 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.2.1 (Oct 24, 2026): no advisory affects it - Newest unaffected release: 4.2.1 (Oct 24, 2026), the latest release - Weekly downloads: 32.4M - Dependents: 527 - Releases: 111 since 0.0.1 (Mar 14, 2015) - Registry: https://www.npmjs.com/package/http-proxy-middleware - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-55603: 3.0.4 to 3.0.6 (3.0.7 is outside it); 4.0.0 to 4.1.0 (4.1.1 is outside it) - CVE-2026-55602: 0.16.0 to 2.0.10-beta.0 (2.0.10 is outside it); 3.0.0 to 3.0.5 (3.0.6 is outside it); 4.0.0 to 4.1.0-beta.2 (4.1.0 is outside it) - CVE-2025-32997: 1.3.0 to 2.0.8 (2.0.9 is outside it); 3.0.0 to 3.0.4 (3.0.5 is outside it) - CVE-2025-32996: 1.3.0 to 2.0.7 (2.0.8 is outside it); 3.0.0 to 3.0.3 (3.0.4 is outside it) - CVE-2024-21536: 0.0.1 to 2.0.7-beta.1 (2.0.7 is outside it); 3.0.0 to 3.0.2 (3.0.3 is outside it) ## Advisories (5) ### [CVE-2026-55603](https://cve.now/CVE-2026-55603): http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in \`fixRequestBody\` - Severity: High 7.5 - Published: Jun 22, 2026 - Affected: from 3.0.4, fixed in 3.0.7; from 4.0.0, fixed in 4.1.1. - Fixed in 3.0.7 (released Jun 14, 2026, 8 days before disclosure) and 4.1.1 (released Jun 14, 2026, 8 days before disclosure). - The latest release, 4.2.1, is not affected. - 11% of http-proxy-middleware downloads last week were affected versions (4.1M). ### [CVE-2026-55602](https://cve.now/CVE-2026-55602): http-proxy-middleware \`router\` host+path substring matching allows Host-header-driven backend routing bypass - Severity: Medium 6.9 - Published: Jun 22, 2026 - Affected: from 3.0.0, fixed in 3.0.6; from 4.0.0, fixed in 4.1.0; from 0.16.0, fixed in 2.0.10. - Fixed in 2.0.10 (released Jun 19, 2026, 3 days before disclosure), 3.0.6 (released Jun 6, 2026, 16 days before disclosure) and 4.1.0 (released Jun 6, 2026, 16 days before disclosure). - The latest release, 4.2.1, is not affected. - 59% of http-proxy-middleware downloads last week were affected versions (22.1M). ### [CVE-2025-32997](https://cve.now/CVE-2025-32997): In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. - Severity: Medium 4.0 - Published: Apr 15, 2025 - Affected: from 1.3.0, fixed in 2.0.9; from 3.0.0, fixed in 3.0.5. - Fixed in 2.0.9 (released Apr 10, 2025, 5 days before disclosure) and 3.0.5 (released Apr 10, 2025, 5 days before disclosure). - The latest release, 4.2.1, is not affected. - 16% of http-proxy-middleware downloads last week were affected versions (6.1M). ### [CVE-2025-32996](https://cve.now/CVE-2025-32996): In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. - Severity: Medium 4.0 - Published: Apr 15, 2025 - Affected: from 1.3.0, fixed in 2.0.8; from 3.0.0, fixed in 3.0.4. - Fixed in 2.0.8 (released Apr 9, 2025, 6 days before disclosure) and 3.0.4 (released Apr 9, 2025, 6 days before disclosure). - The latest release, 4.2.1, is not affected. - 16% of http-proxy-middleware downloads last week were affected versions (5.9M). ### [CVE-2024-21536](https://cve.now/CVE-2024-21536): Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to… - Severity: High 8.7 - Published: Oct 19, 2024 - Affected: fixed in 2.0.7; from 3.0.0, fixed in 3.0.3. - Fixed in 2.0.7 (released Oct 6, 2024, 13 days before disclosure) and 3.0.3 (released Oct 6, 2024, 13 days before disclosure). - The latest release, 4.2.1, is not affected. - 19% of http-proxy-middleware downloads last week were affected versions (7.1M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/http-proxy-middleware Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.