{"cve":"CVE-2026-55603","nvd":{"published":"2026-06-22T21:16:26.033","modified":"2026-10-25T23:10:00.167","status":"Analyzed","description":"http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \\r\\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","score":7.5},"cwes":["CWE-93"],"references":["https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm","https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm"],"products":["chimurai:http-proxy-middleware"],"source":"nvd","synced_at":"2026-10-25T23:44:33.281319194+00:00"},"epss":{"cve":"CVE-2026-55603","score":0.00286,"percentile":0.20894,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-gcq2-9pq2-cxqm","url":"https://osv.dev/vulnerability/GHSA-gcq2-9pq2-cxqm","summary":"http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`","modified":"2026-06-18T13:26:30.358166Z","packages":[{"ecosystem":"npm","name":"http-proxy-middleware","purl":"pkg:npm/http-proxy-middleware","ranges":[">=3.0.4 <3.0.7"],"fixed":["3.0.7"]},{"ecosystem":"npm","name":"http-proxy-middleware","purl":"pkg:npm/http-proxy-middleware","ranges":[">=4.0.0 <4.1.1"],"fixed":["4.1.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}