CVE-2025-32997
1 advisory.
npm/http-proxy-middleware CVE-2025-32997: medium 4, EPSS 0.47%
http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
Action: Upgrade http-proxy-middleware to 2.0.9 or later.
npm i http-proxy-middleware@2.0.9npm i http-proxy-middleware@3.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.0 | 2.0.9 | - |
| 3.0.0 | 3.0.5 | - |
Fixed versions
| 2.0.9 | 3.0.5 |
Sources
- osv: GHSA-9gqv-wp59-fq42
- https://nvd.nist.gov/vuln/detail/CVE-2025-32997
- https://github.com/chimurai/http-proxy-middleware/pull/1096
- https://github.com/chimurai/http-proxy-middleware/commit/1bdccbeec243850f1d2bb50ea0ff2151e725d67e
- https://github.com/chimurai/http-proxy-middleware
- https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9
- https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5
CVE-2025-32997 · published · modified · JSON