The http-proxy-middleware Node.js library versions >=3.0.4 <3.0.7 and >=4.1.0 <4.1.1 contain a CRLF injection vulnerability (CWE-93) in the fixRequestBody() helper function when handling multipart/form-data content types. The function rebuilds the request body by interpolating req.body keys and values directly into the multipart wire format without neutralizing CR/LF sequences. An attacker can exploit this by injecting \r\n characters in keys or values to prematurely close a multipart section and inject new form parts. This causes a mismatch between the proxy's parsed request body and the backend's parsed request body, potentially bypassing gateway-side validation or policy enforcement. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) and affects the specified version ranges. It is fixed in versions 3.0.7 and 4.1.1.

An attacker can exploit this vulnerability to inject additional form parts into multipart/form-data requests by including CRLF sequences in request keys or values. This leads to a desynchronization between the proxy's parsed request body and the backend's parsed request body, potentially allowing bypass of gateway-side validation or security policies. The impact includes partial confidentiality loss and high integrity impact, with no availability impact reported.

Upgrade http-proxy-middleware to version 3.0.7 or later, or 4.1.1 or later, where this vulnerability is fixed. Patch status is not explicitly stated but the description confirms the vulnerability is fixed starting at these versions. Until upgraded, avoid using the fixRequestBody() helper with multipart/form-data content types or apply custom input validation to neutralize CRLF sequences in request keys and values.