http-proxy-middleware can call writeBody twice because "else if" is not used

🗓️ 15 Apr 2025 03:30:34Reported by GitHub Advisory DatabaseType

http-proxy-middleware may call writeBody twice due to missing "else if" condition in versions before 3.0.4

Reporter	Title	Published	Views	Family All 32
IBM Security Bulletins	Security Bulletin: Vulnerability in http-proxy-middleware affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Sep 202513:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple nodejs and go packages which is vulnerable to " CVE-2025-27152, CVE-2025-32996, CVE-2025-32997, CVE-2025-22871"	4 Aug 202507:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in http-proxy-middleware-2.0.7.tgz	27 Aug 202502:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in QRadar Suite Software	13 Mar 202619:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2025.	23 Sep 202521:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Log Source Management app for IBM QRadar SIEM includes components with known vulnerabilities	15 Aug 202514:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Open Source affect IBM Cloud Pak System	11 Nov 202513:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service, SSRF and credential leakage [CVE-2025-27152, CVE-2025-27789, CVE-2025-32996, CVE-2025-32997]	9 May 202514:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses http-proxy-middleware - 2.0.7 which is vulnerable to CVE-2025-32996, CVE-2025-32997.	4 Dec 202514:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in http-proxy-middleware-2.0.7.tgz	26 Aug 202513:25	–	ibm

Vulners

Node

chimurai http-proxy-middlewareRange1.3.0–2.0.8npm

chimurai http-proxy-middlewareRange3.0.0–3.0.4npm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-32996
github	www.github.com/chimurai/http-proxy-middleware/pull/1089
github	www.github.com/chimurai/http-proxy-middleware/commit/020976044d113fc0bcbbaf995e91d05e2829a145
github	www.github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.8
github	www.github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.4
github	www.github.com/advisories/GHSA-4www-5p9h-95mh

28 Apr 2025 14:27Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.14 - 5.3

EPSS0.00059

SSVC

CWE-670