150 matches found
@oslokommune/auth-bff (>=2.0.1, <=2.2.1), @sap/vite-plugin-leanix-custom-report (>=8.6.0, <=8.8.3) +1 more potentially affected by CVE-2026-55603 via http-proxy-middleware (>=4.0.0, <=4.1.0)
http-proxy-middleware NPM version =4.0.0, =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves: CVE-2026-55603 Source advisory: OSV:GHSA-GCQ2-9PQ2-CXQM...
@oslokommune/auth-bff (>=2.0.1, <=2.2.1), @sap/vite-plugin-leanix-custom-report (>=8.6.0, <=8.8.3) +1 more potentially affected by CVE-2026-55603 via http-proxy-middleware (>=4.0.0, <=4.1.0)
http-proxy-middleware NPM version =4.0.0, =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves: CVE-2026-55603 Source advisory: SNYK:JS-HTTPPROXYMIDDLEWARE-17375007...
Partial String Comparison
Overview Affected versions of this package are vulnerable to Partial String Comparison via the router component. An attacker can route requests to unintended backend servers by sending crafted HTTP requests with manipulated Host headers. Remediation Upgrade http-proxy-middleware to version 2.0.10...
@oslokommune/auth-bff (>=2.0.1, <=2.2.1), @sap/vite-plugin-leanix-custom-report (>=8.6.0, <=8.7.1) +1 more potentially affected by CVE-2026-55602 via http-proxy-middleware (4.0.0)
http-proxy-middleware NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on http-proxy-middleware and may be impacted: - @oslokommune/auth-bff =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves: CVE-2026-55602 Source advisory: GHSA-64MM-VXMG-Q3VJ...
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
Summary http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configur...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +31042 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=0.16.0, <=2.0.9)
http-proxy-middleware NPM version =0.16.0, =1.0.1, =1.1.0 - 0726react 0.1.1 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 -...
@adyen/adyen-salesforce-pwa (>=2.0.0, <=3.0.4), @amazeelabs/publisher (>=2.4.28, <=3.2.6) +199 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=3.0.0, <=3.0.5)
http-proxy-middleware NPM version =3.0.0, =2.0.0, =2.4.28, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.3, =1.0.0, =0.9.1-next.19, =0.9.1-next.19, =0.9.1-next.19, =0.0.4, =3.0.0-alpha-1, =24.3.0-depup.0, =24.11.1-depup.1 and more Source cves: CVE-2026-55602 Source advisory:...
@oslokommune/auth-bff (>=2.0.1, <=2.2.1), @sap/vite-plugin-leanix-custom-report (>=8.6.0, <=8.7.1) +1 more potentially affected by CVE-2026-55602 via http-proxy-middleware (4.0.0)
http-proxy-middleware NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on http-proxy-middleware and may be impacted: - @oslokommune/auth-bff =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves: CVE-2026-55602 Source advisory:...
@adyen/adyen-salesforce-pwa (>=2.0.0, <=3.0.4), @amazeelabs/publisher (>=2.4.28, <=3.2.6) +199 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=3.0.0, <=3.0.5)
http-proxy-middleware NPM version =3.0.0, =2.0.0, =2.4.28, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.3, =1.0.0, =0.9.1-next.19, =0.9.1-next.19, =0.9.1-next.19, =0.0.4, =3.0.0-alpha-1, =24.3.0-depup.0, =24.11.1-depup.1 and more Source cves: CVE-2026-55602 Source advisory:...
GHSA-64MM-VXMG-Q3VJ http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
Summary http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configur...
@adyen/adyen-salesforce-pwa (>=2.0.0, <=3.0.4), @amazeelabs/publisher (>=2.4.28, <=3.2.6) +199 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=3.0.0, <=3.0.5)
http-proxy-middleware NPM version =3.0.0, =2.0.0, =2.4.28, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.3, =1.0.0, =0.9.1-next.19, =0.9.1-next.19, =0.9.1-next.19, =0.0.4, =3.0.0-alpha-1, =24.3.0-depup.0, =24.11.1-depup.1 and more Source cves: CVE-2026-55602 Source advisory:...
@oslokommune/auth-bff (>=2.0.1, <=2.2.1), @sap/vite-plugin-leanix-custom-report (>=8.6.0, <=8.7.1) +1 more potentially affected by CVE-2026-55602 via http-proxy-middleware (4.0.0)
http-proxy-middleware NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on http-proxy-middleware and may be impacted: - @oslokommune/auth-bff =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves: CVE-2026-55602 Source advisory: OSV:GHSA-64MM-VXMG-Q3...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +31042 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=0.16.0, <=2.0.9)
http-proxy-middleware NPM version =0.16.0, =1.0.1, =1.1.0 - 0726react 0.1.1 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 -...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +31042 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=0.16.0, <=2.0.9)
http-proxy-middleware NPM version =0.16.0, =1.0.1, =1.1.0 - 0726react 0.1.1 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 -...
NPM: http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
NPM: http-proxy-middleware router host+path substring matching allows Host-header-driven backend routing bypass vulnerability discovered by ? in WordPress Npm http-proxy-middleware versions = 0.16.0, 2.0.10...
CVE-2026-55603
creationtimestamp| type| source ---|---|--- 2026-06-17 17:17:39+00:00| published-proof-of-concept| https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm 2026-06-23 09:03:07+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mox25jonrk2t...
CVE-2026-55602
creationtimestamp| type| source ---|---|--- 2026-06-17 17:17:28+00:00| published-proof-of-concept| https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj...
WS-2021-0015
All versions of http-proxy-middelware contain malicious code. The index.js file attempts to download a file from a remote server and execute it. The file is not run upon installation - the package needs to be required or the index.js run manually...
Security Bulletin: IBM Edge Data Collector uses http-proxy-middleware - 2.0.7 which is vulnerable to CVE-2025-32996, CVE-2025-32997.
Summary IBM Edge Data Collector uses http-proxy-middleware - 2.0.7 which is vulnerable to CVE-2025-32996, CVE-2025-32997. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2025-32996 DESCRIPTION: In http-proxy-middleware before 2.0.8 and 3.x before...
