Improper Input Validation in http-proxy-middleware Versions from Chimurai

CVE-2025-32996

What is CVE-2025-32996?

The http-proxy-middleware package has a vulnerability that allows the writeBody function to be executed multiple times due to an issue with the logic structure lacking an 'else if' condition. This flaw can lead to improper handling of HTTP requests, potentially causing erroneous behaviors within applications that rely on the middleware. It is essential for developers using this package to upgrade to at least version 2.0.8 or 3.0.4 to mitigate the risk associated with this vulnerability.

References