CVE-2026-55602 Details
Description
http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.
A vulnerability exists in http-proxy-middleware versions 0.16.0 prior to 2.0.10, 3.0.0 prior to 3.0.6, and 4.0.0 prior to 4.1.0. The issue arises in the router proxy-table implementation, which uses unanchored substring matching based on request metadata controlled by the attacker. This flaw allows a crafted Host header, matching a configured host+path key as a substring, to route a request to an unintended backend. The vulnerability can be exploited by sending an HTTP request with a manipulated Host header that exploits this substring matching flaw, bypassing intended routing to the correct backend.
Users can upgrade to http-proxy-middleware versions 2.0.10, 3.0.6, or 4.1.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj | CISA-ADP | ExploitVendor Advisory |
| https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-187 | Partial String Comparison | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| chimurai http-proxy-middleware | >= 0.16.0, < 2.0.10 >= 3.0.0, < 3.0.6 >= 4.0.0, < 4.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |