CVE-2026-55603 Details

A vulnerability exists in http-proxy-middleware versions 3.0.4 prior to 3.0.7 and 4.0.0 prior to 4.1.1. The issue arises in the library's fixRequestBody() function, which is intended to re-emit a request body that has already been processed by a body parser. When the outgoing Content-Type is multipart/form-data, the function rebuilds the body by directly inserting each key and value from req.body into the multipart format without properly escaping carriage return and line feed characters. This oversight allows an attacker to close the current part and inject a new form part. As a result, any validation or policy applied to req.body is misaligned with what the upstream backend ultimately processes, creating a desynchronization across the trust boundary.

Update to http-proxy-middleware version 3.0.7 or 4.1.1. If using an earlier version, neutralize carriage return and line feed characters in multipart field names and values before interpolation, or use a proper multipart encoder like FormData or the form-data package.