Threat Intelligence Database

CVE-2026-55603 is a CRLF injection vulnerability in the chimurai http-proxy-middleware for Node.js. The issue occurs in versions from 3.0.4 until 3.0.7 and 4.1.1, specifically in the fixRequestBody() helper when handling multipart/form-data content types. The vulnerability allows an attacker to inject additional form parts by including CRLF sequences in request body keys or values, causing a desynchronization between the proxy's parsed request body and the backend's interpretation. This can lead to bypassing gateway-side validation and potentially injecting malicious parameters. The vulnerability has a CVSS 3.1 score of 7.5 (high severity).

http-proxy-middleware versions prior to 2.0.10, 3.0.6, and 4.1.0 have an improper input validation vulnerability in the host+path router proxy-table entries. The implementation uses unanchored substring matching on the Host header, allowing crafted Host headers that partially match configured keys to route requests to unintended backends. This vulnerability has a medium severity with a CVSS score of 6.9. Fixes are available in versions 2.0.10, 3.0.6, and 4.1.0.