CVE-2026-55602
Severity CVSS v4.0:
MEDIUM
Type:
CWE-20
Input Validation
Publication date:
22/06/2026
Last modified:
26/06/2026
Description
http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.
Impact
Base Score 4.0
6.90
Severity 4.0
MEDIUM
Base Score 3.x
8.60
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:* | 0.16.0 (including) | 2.0.10 (excluding) |
| cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:* | 3.0.0 (including) | 3.0.6 (excluding) |
| cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:* | 4.0.0 (including) | 4.1.0 (excluding) |
To consult the complete list of CPE names with products and versions, see this page