GHSA-9GQV-WP59-FQ42 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

@amazeelabs/publisher (>=2.4.28, <=3.2.6), @angular-devkit/build-angular (>=18.0.0-next.3, <=20.0.0-next.5) +82 more potentially affected by CVE-2025-32997 via http-proxy-middleware (>=3.0.0, <=3.0.3)

http-proxy-middleware NPM version =3.0.0, =2.4.28, =18.0.0-next.3, =1.0.0, =18.0.0-next.39, =18.0.0-next.39, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =8.10.0-nightly.20240906232837, =9.0.0, =9.0.0, =9.0.0, =3.11.0-beta.6, =3.26.12 and more Source cves:...

GHSA-4WWW-5P9H-95MH http-proxy-middleware can call writeBody twice because "else if" is not used

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

http-proxy-middleware can call writeBody twice because "else if" is not used

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

PT-2025-16284

Name of the Vulnerable Software and Affected Versions http-proxy-middleware versions 2.0.9 and earlier, 3.x versions prior to 3.0.5 Description The issue arises when fixRequestBody proceeds even if bodyParser has failed. This can lead to potential security risks. Recommendations For versions prio...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

CVE-2025-32997: Improper Check for Unusual or Exceptional Conditions

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

@amazeelabs/publisher (>=2.4.28, <=3.2.6), @angular-devkit/build-angular (>=18.0.0-next.3, <=20.0.0-next.5) +82 more potentially affected by CVE-2025-32997 via http-proxy-middleware (>=3.0.0, <=3.0.3)

http-proxy-middleware NPM version =3.0.0, =2.4.28, =18.0.0-next.3, =1.0.0, =18.0.0-next.39, =18.0.0-next.39, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =8.10.0-nightly.20240906232837, =9.0.0, =9.0.0, =9.0.0, =3.11.0-beta.6, =3.26.12 and more Source cves:...

http-proxy-middleware security vulnerabilities

http-proxy-middleware is a Node.js http proxy middleware for connect, express, next.js, etc. by Steven Chim Personal Developer. A security vulnerability exists in http-proxy-middleware versions prior to 2.0.8 and prior to 3.0.4, which stems from the fact that writeBody may be called twice...

CVE-2025-32996

CVE-2025-32996 affects the http-proxy-middleware project where, in versions before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because an else-if is missing. This is the underlying root cause and is reflected in related IBM and IBM X-Force bulletins that cite the same description. T...

CVE-2025-32997

In CVE-2025-32997, the http-proxy-middleware has a flaw where fixRequestBody proceeds even if bodyParser has failed, affecting versions: 2.0.7/2.0.8 (before 2.0.9) and 3.x before 3.0.5. The Connected IBM bulletin confirms the root cause and lists remediation: upgrade to http-proxy-middleware v2.0...

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

CVE-2025-32996: Always-Incorrect Control Flow Implementation

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

@amazeelabs/publisher (>=2.4.28, <=3.2.6), @angular-devkit/build-angular (>=18.0.0-next.3, <=20.0.0-next.5) +82 more potentially affected by CVE-2025-32996 via http-proxy-middleware (>=3.0.0, <=3.0.3)

http-proxy-middleware NPM version =3.0.0, =2.4.28, =18.0.0-next.3, =1.0.0, =18.0.0-next.39, =18.0.0-next.39, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =8.10.0-nightly.20240906232837, =9.0.0, =9.0.0, =9.0.0, =3.11.0-beta.6, =3.26.12 and more Source cves:...

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...