http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

Description

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

Recommendation

Update the http-proxy-middleware package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.3.0, < 2.0.9

  >= 3.0.0, < 3.0.5**

• Patched version(s): **2.0.9

  3.0.5**

References

• GHSA-9gqv-wp59-fq42
• CVE-2025-32997
• CWE-754
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse - CVE-2026-22774
• pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding - CVE-2025-11362
• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
• http-proxy-middleware can call writeBody twice because "else if" is not used - CVE-2025-32996

Tags:

npm

http-proxy-middleware