CVE-2026-55603

http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \r\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.

• CWE-93

• https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqmExploit, Mitigation, Vendor Advisory
• https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqmExploit, Mitigation, Vendor Advisory

Published

Jun 22, 2026

Last Modified

Jun 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55595ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-55596Plate is a rich-text editor with AI and shadcn/ui. From 53.0…8.7
• CVE-2026-55597ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55599phpseclib is a PHP secure communications library. From 0.1.1…5.8
• CVE-2026-5560A vulnerability was found in PHPGurukul Online Shopping Port…6.3
• CVE-2026-55602http-proxy-middleware is node.js http-proxy middleware. From…8.6
• CVE-2026-55604DeepSeek MCP Server is an MCP server for DeepSeek V4. Starti…8.6
• CVE-2026-55605DeepSeek MCP Server is an MCP server for DeepSeek V4. Starti…5.3
• CVE-2026-55607Claude Code is an agentic coding tool. From 2.1.38 until 2.…8.8
• CVE-2026-55608n8n-MCP is an MCP server that provides AI assistants access …5.4
• CVE-2026-5561A vulnerability was determined in Campcodes Complete POS Man…6.3
• CVE-2026-55611AnythingLLM is an application that turns pieces of content i…0