http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
- Severity:
- Medium
Description
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
Recommendation
Update the http-proxy-middleware package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.3.0, < 2.0.9 >= 3.0.0, < 3.0.5** Patched version(s): **2.0.9 3.0.5**
References
Related Issues
- Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
- Improper Verification of Cryptographic Signature in node-forge (GHSA-cfm4-qjh2-4765) - CVE-2022-24771
- Denial of service in http-proxy-middleware - CVE-2024-21536
- DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS - Vulnerability
- Tags:
- npm
- http-proxy-middleware
Anything's wrong? Let us know Last updated on April 28, 2025