CVE-2026-55602

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj	Exploit Vendor Advisory
https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:chimurai:http-proxy-middleware::::::::
	cpe:2.3:a:chimurai:http-proxy-middleware::::::::
	cpe:2.3:a:chimurai:http-proxy-middleware::::::::

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) http-proxy-middleware es un middleware http-proxy de node.js. Desde la versión 0.16.0 hasta la 2.0.10, 3.0.6 y 4.1.0, http-proxy-middleware documenta las entradas de la tabla de proxy del router como selectores de host, path o host+path, pero la implementación de host+path utiliza coincidencia de subcadenas no ancladas en metadatos de solicitud controlados por el atacante. Como resultado, un encabezado Host manipulado que es solo una coincidencia de supercadena para una clave host+path configurada aún puede enrutar una solicitud a un backend no deseado. Esta vulnerabilidad está corregida en 2.0.10, 3.0.6 y 4.1.0.

Information

Published : 2026-06-22 18:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-55602

Mitre link : CVE-2026-55602

CVE.ORG link : CVE-2026-55602

JSON object : View

Products Affected

chimurai

http-proxy-middleware

CWE

CWE-20

Improper Input Validation

CWE-187

Partial String Comparison

{"id": "CVE-2026-55602", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55602", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T14:17:17.328115Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "chimurai", "product": "http-proxy-middleware", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.1.0"}, {"status": "affected", "version": ">= 3.0.0, < 3.0.6"}, {"status": "affected", "version": ">= 0.16.0, < 2.0.10"}]}]}], "published": "2026-06-22T18:16:48.073", "references": [{"url": "https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-187"}]}], "descriptions": [{"lang": "en", "value": "http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0."}, {"lang": "es", "value": "http-proxy-middleware es un middleware http-proxy de node.js. Desde la versi\u00f3n 0.16.0 hasta la 2.0.10, 3.0.6 y 4.1.0, http-proxy-middleware documenta las entradas de la tabla de proxy del router como selectores de host, path o host+path, pero la implementaci\u00f3n de host+path utiliza coincidencia de subcadenas no ancladas en metadatos de solicitud controlados por el atacante. Como resultado, un encabezado Host manipulado que es solo una coincidencia de supercadena para una clave host+path configurada a\u00fan puede enrutar una solicitud a un backend no deseado. Esta vulnerabilidad est\u00e1 corregida en 2.0.10, 3.0.6 y 4.1.0."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3DAE327-1562-441D-B830-469D446A94D7", "versionEndExcluding": "2.0.10", "versionStartIncluding": "0.16.0"}, {"criteria": "cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14022245-63AB-44F8-89C2-06AC2432A8A2", "versionEndExcluding": "3.0.6", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "474C2CF5-4DCF-455B-A550-EEFDDB585FD4", "versionEndExcluding": "4.1.0", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}