MEDIUM 4.0 npm
GHSA-4www-5p9h-95mh · CVE-2025-32996 http-proxy-middleware can call writeBody twice because "else if" is not used
Modified: 2/4/2026
package
npm / http-proxy-middleware
pkg:npm/http-proxy-middleware
MEDIUM npm
GHSA-64mm-vxmg-q3vj · CVE-2026-55602 http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
Modified: 6/18/2026
MEDIUM 4.0 npm
GHSA-9gqv-wp59-fq42 · CVE-2025-32997 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
Modified: 2/4/2026
HIGH 7.5 npm
GHSA-c7qv-q95q-8v27 · CVE-2024-21536 Denial of service in http-proxy-middleware
Modified: 2/4/2026
HIGH 7.5 npm
GHSA-gcq2-9pq2-cxqm · CVE-2026-55603 http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
Modified: 6/18/2026