{"action":"Upgrade http-proxy-middleware to 2.0.8 or later.","affected":[{"fixed":"2.0.8","introduced":"1.3.0"},{"fixed":"3.0.4","introduced":"3.0.0"}],"component":"http-proxy-middleware","cve_ids":["CVE-2025-32996"],"ecosystem":"npm","epss":0.00475,"exploited":false,"fixed_versions":["2.0.8","3.0.4"],"ghsa_id":"GHSA-4www-5p9h-95mh","id":"tcs_01M5KF1T27CH91EQ04406BPVKH","modified_at":"2026-09-10T03:50:23.529249265Z","published_at":"2025-04-15T03:30:34Z","references":["https://osv.dev/vulnerability/GHSA-4www-5p9h-95mh","https://nvd.nist.gov/vuln/detail/CVE-2025-32996","https://github.com/chimurai/http-proxy-middleware/pull/1089","https://github.com/chimurai/http-proxy-middleware/commit/020976044d113fc0bcbbaf995e91d05e2829a145","https://github.com/chimurai/http-proxy-middleware","https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.8","https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.4"],"severity":{"label":"medium","score":4},"sources":[{"source":"osv","source_id":"GHSA-4www-5p9h-95mh","url":"https://osv.dev/vulnerability/GHSA-4www-5p9h-95mh"}],"summary":"http-proxy-middleware can call writeBody twice because \"else if\" is not used"}