http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

🗓️ 15 Apr 2025 03:30:34Reported by GitHub Advisory DatabaseType

http-proxy-middleware allows fixRequestBody to proceed despite bodyParser failures in specific versions.

Reporter	Title	Published	Views	Family All 32
IBM Security Bulletins	Security Bulletin: Vulnerability in http-proxy-middleware affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Sep 202513:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple nodejs and go packages which is vulnerable to " CVE-2025-27152, CVE-2025-32996, CVE-2025-32997, CVE-2025-22871"	4 Aug 202507:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in http-proxy-middleware-2.0.7.tgz	27 Aug 202502:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in QRadar Suite Software	13 Mar 202619:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2025.	23 Sep 202521:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Log Source Management app for IBM QRadar SIEM includes components with known vulnerabilities	15 Aug 202514:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Open Source affect IBM Cloud Pak System	11 Nov 202513:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service, SSRF and credential leakage [CVE-2025-27152, CVE-2025-27789, CVE-2025-32996, CVE-2025-32997]	9 May 202514:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses http-proxy-middleware - 2.0.7 which is vulnerable to CVE-2025-32996, CVE-2025-32997.	4 Dec 202514:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in http-proxy-middleware-2.0.7.tgz	26 Aug 202513:25	–	ibm

Vulners

Node

chimurai http-proxy-middlewareRange1.3.0–2.0.9npm

chimurai http-proxy-middlewareRange3.0.0–3.0.5npm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-32997
github	www.github.com/chimurai/http-proxy-middleware/pull/1096
github	www.github.com/chimurai/http-proxy-middleware/commit/1bdccbeec243850f1d2bb50ea0ff2151e725d67e
github	www.github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9
github	www.github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5
github	www.github.com/advisories/GHSA-9gqv-wp59-fq42

28 Apr 2025 14:28Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.14 - 5.3

EPSS0.00062

SSVC

CWE-754