npm/http-proxy-middleware CVE-2026-55603: high 7.5, EPSS 0.29%
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
Action: Upgrade http-proxy-middleware to 3.0.7 or later.
npm i http-proxy-middleware@3.0.7npm i http-proxy-middleware@4.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.4 | 3.0.7 | - |
| 4.0.0 | 4.1.1 | - |
Fixed versions
| 3.0.7 | 4.1.1 |
Sources
- osv: GHSA-gcq2-9pq2-cxqm
- https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm
- https://github.com/chimurai/http-proxy-middleware
CVE-2026-55603 · published · modified · JSON