CVE-2026-55602

HighCVSS 8.6/10Last modified Oct 25, 2026

Description

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-20 CWE-187

Affected software

Vendor	Product	Versions
chimurai	http-proxy-middleware	>= 4.0.0, < 4.1.0; >= 3.0.0, < 3.0.6; >= 0.16.0, < 2.0.10

References

https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vjExploit, Vendor Advisory
https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vjExploit, Vendor Advisory

Timeline

Published: Jun 22, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-556037.5http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helpe CVE-2026-556048.6DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore CVE-2026-556055.3DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.8.0, the self-hosted HTTP transport o CVE-2026-556066.5odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detect CVE-2026-556078.8Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git CVE-2026-556085.4n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-te CVE-2026-556097.1sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consc CVE-2026-55616.3A vulnerability was determined in Campcodes Complete POS Management and Inventory System up to 4.0.6. This affects an unknown function of th CVE-2026-556108.7InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to CVE-2026-556110.0AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 unti CVE-2026-556123.7uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length l CVE-2026-556136.9uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundarie