http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

Description

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

Recommendation

Update the http-proxy-middleware package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.3.0, < 2.0.9

  >= 3.0.0, < 3.0.5**

• Patched version(s): **2.0.9

  3.0.5**

References

• GHSA-9gqv-wp59-fq42
• CVE-2025-32997
• CWE-754
• CAPEC-310
• OWASP 2021-A6

Related Issues

• http-proxy-middleware can call writeBody twice because "else if" is not used - CVE-2025-32996
• Denial of service in http-proxy-middleware - CVE-2024-21536
• Astro Development Server has Arbitrary Local File Read - CVE-2025-64757
• Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass - CVE-2025-64525

Tags:

npm

http-proxy-middleware