http-proxy-middleware can call writeBody twice because "else if" is not used

中危 5.3CVE-2025-32996 · GHSA-4www-5p9h-95mh · Published 15/04/2025 · updated 17/06/2026

要点

CVE-2025-32996 是影响 http-proxy-middleware (chimurai), http-proxy-middleware 的中危 (CVSS 5.3)漏洞。
未来 30 天内被利用的概率（EPSS）：0.47%，高于 40.4% 的漏洞。
修复：升级到 3.0.4, 2.0.8 或更高版本。

Package	Affected versions	Patched versions
http-proxy-middleware chimurai	`≥ 3.0.0, < 3.0.4< 2.0.8`	`3.0.42.0.8`
http-proxy-middleware npm	`≥ 1.3.0, < 2.0.8≥ 3.0.0, < 3.0.4`	`2.0.83.0.4`

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.

NVD description

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 3.0.0, < 3.0.4< 2.0.8

3.0.42.0.8

npm

≥ 1.3.0, < 2.0.8≥ 3.0.0, < 3.0.4

2.0.83.0.4

http-proxy-middleware 的其他漏洞

查看全部 →