CVE-2026-55602
1 advisory.
npm/http-proxy-middleware CVE-2026-55602: medium
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
Action: Upgrade http-proxy-middleware to 2.0.10 or later.
npm i http-proxy-middleware@3.0.6npm i http-proxy-middleware@4.1.0npm i http-proxy-middleware@2.0.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.0.6 | - |
| 4.0.0 | 4.1.0 | - |
| 0.16.0 | 2.0.10 | - |
Fixed versions
| 3.0.6 | 4.1.0 | 2.0.10 |
Sources
- osv: GHSA-64mm-vxmg-q3vj
- https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj
- https://github.com/chimurai/http-proxy-middleware
CVE-2026-55602 · published · modified · JSON