http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

MEDIO 5.3CVE-2025-32997 · GHSA-9gqv-wp59-fq42 · Published 15/04/2025 · updated 17/06/2026

En resumen

CVE-2025-32997 es una vulnerabilidad MEDIO (CVSS 5.3) que afecta a http-proxy-middleware (chimurai), http-proxy-middleware.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.47%, mayor que el 40.9% de las vulnerabilidades.
Solución: actualizar a 3.0.5, 2.0.9 o posterior.

Package	Affected versions	Patched versions
http-proxy-middleware chimurai	`≥ 3.0.0, < 3.0.5< 2.0.9`	`3.0.52.0.9`
http-proxy-middleware npm	`≥ 1.3.0, < 2.0.9≥ 3.0.0, < 3.0.5`	`2.0.93.0.5`

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

NVD description

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 3.0.0, < 3.0.5< 2.0.9

3.0.52.0.9

npm

≥ 1.3.0, < 2.0.9≥ 3.0.0, < 3.0.5

2.0.93.0.5

Más vulnerabilidades de http-proxy-middleware

Ver todo →