CVE-2026-55602
http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.
- CVSS 4.0
- 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-20, CWE-187
- Published
- Modified
- Record from
- the NVD, synced
Affected
- chimurai:http-proxy-middleware
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-64mm-vxmg-q3vj | npm | http-proxy-middleware | >=3.0.0 <3.0.6 | 3.0.6 |
| GHSA-64mm-vxmg-q3vj | npm | http-proxy-middleware | >=4.0.0 <4.1.0 | 4.1.0 |
| GHSA-64mm-vxmg-q3vj | npm | http-proxy-middleware | >=0.16.0 <2.0.10 | 2.0.10 |