chimurai http-proxy-middleware up to 3.0.6/4.1.0 Upstream Backend fixRequestBody crlf injection

Summaryinfo

A vulnerability marked as critical has been reported in chimurai http-proxy-middleware up to 3.0.6/4.1.0. This affects the function fixRequestBody of the component Upstream Backend. Performing a manipulation results in crlf injection. This vulnerability is identified as CVE-2026-55603. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in chimurai http-proxy-middleware up to 3.0.6/4.1.0. It has been classified as critical. This affects the function fixRequestBody of the component Upstream Backend. The manipulation with an unknown input leads to a crlf injection vulnerability. CWE is classifying the issue as CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \r\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-55603 since 06/17/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.0.7 or 4.1.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Middleware

Vendor

• chimurai

Name

• http-proxy-middleware

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 4.0
• 4.1.0

Website

• Product: https://github.com/chimurai/http-proxy-middleware/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion