CVE-2026-55602http-proxy-middleware is node.js http-proxy middleware.
Updated under an hour ago ()
Does this affect you?
It affects chimurai http-proxy-middleware. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.
- CVSS
- 8.6 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- Weakness (CWE)
- CWE-20, CWE-187
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 26, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
chimurai http-proxy-middleware chimurai:http-proxy-middleware | from 0.16.0 before 2.0.10; from 3.0.0 before 3.0.6; from 4.0.0 before 4.1.0 | NVD |
References
- https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vjexploit, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.