Denial Of Service (DoS)

http-proxy-middleware is vulnerable to Denial Of Service DoS. The vulnerability is due to improper conditional logic due to the absence of "else if", which allows an attacker to trigger writeBody twice and potentially disrupt normal application behavior...

Improper Request Handling

http-proxy-middleware is vulnerable to Improper Request Handling. The vulnerability is due to improper request handling caused by fixRequestBody executing even when bodyParser has failed, which allows attackers to smuggle malicious HTTP requests...

Important: Red Hat Security Advisory: ACS 4.5 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security RHACS. This release of RHACS includes the following bug fix: Fixed a bug to match the aggregation field of the compliance tables to the widgets for consistency. This release also addresses the following security vulnerabilitie...

Always-Incorrect Control Flow Implementation

Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation in the fixRequestBody function. An attacker can cause writeBody to be called multiple times, leading to unexpected behavior. Remediation A fix was pushed into the master branch but not yet...

http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

7qb-cli (=0.0.16), 8-divine (=1.4.0) +2609 more potentially affected by CVE-2025-32996 via http-proxy-middleware (>=1.3.0 <=2.0.7)

http-proxy-middleware NPM version =1.3.0, =0.0.6, =0.1.10, =0.2.14, =1.6.0, =1.7.0, =0.0.39, =7.0.0, =7.0.0, =1.0.0, =5.0.0, =1.3.0, =3.0.0-beta.7 and more Source cves: CVE-2025-32996 Source advisory: OSV:GHSA-4WWW-5P9H-95MH...

@amazeelabs/publisher (>=2.4.28 <=3.2.6), @appliedblockchain/silentdatarollup-custom-rpc (>=1.0.0 <=1.0.1) +26 more potentially affected by CVE-2025-32996 via http-proxy-middleware (>=3.0.0 <=3.0.3)

http-proxy-middleware NPM version =3.0.0, =2.4.28, =1.0.0, =2.1.0-next.0, =2.1.0-next.0, =9.0.0, =9.0.0, =9.0.0, =1.1.0, =19.0.0-alpha.0, =0.0.24, =0.0.1, =8.0.0, =0.391.0, =0.1.55, =3.9.5-beta.0, =3.50.0-beta.2 and more Source cves: CVE-2025-32996 Source advisory: OSV:GHSA-4WWW-5P9H-95MH...

http-proxy-middleware can call writeBody twice because "else if" is not used

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

@amazeelabs/publisher (>=2.4.28 <=3.2.6), @appliedblockchain/silentdatarollup-custom-rpc (>=1.0.0 <=1.0.1) +26 more potentially affected by CVE-2025-32997 via http-proxy-middleware (>=3.0.0 <=3.0.3)

http-proxy-middleware NPM version =3.0.0, =2.4.28, =1.0.0, =2.1.0-next.0, =2.1.0-next.0, =9.0.0, =9.0.0, =9.0.0, =1.1.0, =19.0.0-alpha.0, =0.0.24, =0.0.1, =8.0.0, =0.391.0, =0.1.55, =3.9.5-beta.0, =3.50.0-beta.2 and more Source cves: CVE-2025-32997 Source advisory: OSV:GHSA-9GQV-WP59-FQ42...

GHSA-4WWW-5P9H-95MH http-proxy-middleware can call writeBody twice because "else if" is not used

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

GHSA-9GQV-WP59-FQ42 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

PT-2025-16283 · Unknown · Http-Proxy-Middleware

Name of the Vulnerable Software and Affected Versions: http-proxy-middleware versions 2.0.7 and earlier, http-proxy-middleware versions 3.x before 3.0.4 Description: The issue arises because writeBody can be called twice due to the absence of "else if". This can lead to information disclosure...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

CVE-2025-32996

CVE-2025-32996 affects the http-proxy-middleware project where, in versions before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because an else-if is missing. This is the underlying root cause and is reflected in related IBM and IBM X-Force bulletins that cite the same description. T...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

http-proxy-middleware 安全漏洞

http-proxy-middleware is a Node.js http proxy middleware for connect, express, next.js, etc. by Steven Chim Personal Developer. A security vulnerability exists in http-proxy-middleware versions prior to 2.0.8 and prior to 3.0.4, which stems from the fact that writeBody may be called twice...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...