GHSA-gcq2-9pq2-cxqm
High · 7.5CVSS
7.5
EPSS
—
Published
Jun 18, 2026
CISA due date
—
The record
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | http-proxy-middleware | 3.0.4 | 3.0.7 |
| npm | http-proxy-middleware | 4.0.0 | 4.1.1 |
Related vulnerabilities
- CVE-2026-55603 http-proxy-middleware is node.js http-proxy middleware. Same vulnerability
- CVE-2026-55602 http-proxy-middleware is node.js http-proxy middleware. Also affects http-proxy-middleware
- GHSA-64mm-vxmg-q3vj http-proxy-middleware `router` host+path substring matching allows Host-header-driven… Also affects http-proxy-middleware
- CVE-2025-32996 http-proxy-middleware can call writeBody twice because "else if" is not used Also affects http-proxy-middleware
- CVE-2025-32997 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed Also affects http-proxy-middleware
- CVE-2024-21536 Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3… Also affects http-proxy-middleware
- CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command… CWE-93
- CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-93