CVE-2026-55602
High
Description
http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.
SeverityHigh
CVSS8.6
Exploit probability—
ProductChimurai Http-proxy-middleware
PublishedJun 22, 2026
First seenJun 22, 2026
Weakness typeCWE-20Improper input validationCWE-187CWE-187
How to fix
Update
- chimurai http-proxy-middleware2.0.10, 3.0.6, 4.1.0 or later
- http-proxy-middleware3.0.6, 4.1.0, 2.0.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chimurai http-proxy-middleware | 0.16.0 ≤ v < 2.0.10, 3.0.0 ≤ v < 3.0.6, 4.0.0 ≤ v < 4.1.0 | 2.0.10, 3.0.6, 4.1.0 |
| http-proxy-middlewarenpm | 3.0.0 ≤ v < 3.0.6, 4.0.0 ≤ v < 4.1.0, 0.16.0 ≤ v < 2.0.10 | 3.0.6, 4.1.0, 2.0.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.