http-proxy-middleware can call writeBody twice because "else if" is not used
- Severity:
- Medium
Description
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because “else if” is not used.
Recommendation
Update the http-proxy-middleware package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.3.0, < 2.0.8 >= 3.0.0, < 3.0.4** Patched version(s): **2.0.8 3.0.4**
References
Related Issues
- Regular Expression Denial of Service (ReDoS) in lodash (GHSA-29mw-wpgm-hmr9) - CVE-2020-28500
- CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - CVE-2025-58064
- Payload's SQLite adapter Session Fixation vulnerability (GHSA-26rv-h2hf-3fw4) - CVE-2025-4644
- http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed - CVE-2025-32997
- Tags:
- npm
- http-proxy-middleware
Anything's wrong? Let us know Last updated on April 28, 2025