HTTP Proxy Middleware Vulnerability in Node.js by Chimurai
CVE-2026-55602

6.9MEDIUM

Key Information:

Vendor

Chimurai

Status
Http-proxy-middleware
Vendor
CVE Published:
22 June 2026

What is CVE-2026-55602?

The http-proxy-middleware for Node.js has a vulnerability in the handling of router proxy-table entries which allows for unanchored substring matching on attacker-controlled metadata. This flaw can lead to unintended backend routing if an attacker sends a crafted Host header designed to match a configured host+path key. The issue is present in versions up to 2.0.9, and in specific versions 3.0.6 and 4.1.0, necessitating an upgrade to patched versions to secure the application.

Affected Version(s)

http-proxy-middleware >= 4.0.0, < 4.1.0 < 4.0.0, 4.1.0

http-proxy-middleware >= 3.0.0, < 3.0.6 < 3.0.0, 3.0.6

http-proxy-middleware >= 0.16.0, < 2.0.10 < 0.16.0, 2.0.10

References

https://github.com/chimurai/http-proxy-middleware/securit...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.