Junglewise Threat Intelligence

CVE-2025-32996: http-proxy-middleware double write in fixRequestBody

CVE-2025-32996 · Severity: low · CVSS 3.1 · Published 2025-04-15

Technologies: Chimurai Http-Proxy-Middleware.

Executive brief

http-proxy-middleware is a Node.js library that handles HTTP proxying for web applications. A logic flaw causes the writeBody function to be called twice, potentially resulting in errors when trying to set HTTP headers after they have already been sent to the client. This can cause request proxying to fail and affect service availability.

Technical details

The vulnerability exists in the fixRequestBody handler where conditional logic uses "if" statements instead of "else if", allowing the writeBody function to be executed multiple times. This double execution results in attempts to set HTTP headers after they have been sent to the client, triggering "Cannot set headers after they are sent" errors. The vulnerability was introduced in version 1.3.0 and affects versions 1.3.0-2.0.7 and 3.0.0-3.0.3. The attack vector is network-based with no authentication required; any request processed through the affected middleware can trigger the flaw. Patches are available in versions 2.0.8 and 3.0.4.

Affected products

  • chimurai http-proxy-middleware 1.3.0 through 2.0.7, 3.0.0 through 3.0.3

Timeline

  • 2025-04-15: disclosed: Vulnerability published to advisories
  • 2025-04-09: patched: Fixed in version 2.0.8 and 3.0.4

References