Is CVE-2025-32996 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-32996 being exploited in the wild.

How severe is CVE-2025-32996?

Low severity, with a CVSS score of 3.1, published 15 April 2025.

Which products and versions are affected?

http-proxy-middleware (npm) SEMVER:introduced=1.3.0,fixed=2.0.8.

Is there a fix for CVE-2025-32996?

Yes. http-proxy-middleware (npm): upgrade to 2.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-32996 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-32996?

Check whether you run http-proxy-middleware (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-32996: http-proxy-middleware double write in fixRequestBody

CVE-2025-32996 · Severity: low · CVSS 3.1 · Published 2025-04-15

http-proxy-middleware is a Node.js library that handles HTTP proxying for web applications. A logic flaw causes the writeBody function to be called twice, potentially resulting in errors when trying to set HTTP headers after they have already been sent to the client. This can cause request proxying to fail and affect service availability.

Technologies: http-proxy-middleware (npm). Vendors: npm.

Quick answers

Is CVE-2025-32996 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-32996 being exploited in the wild.
How severe is CVE-2025-32996?: Low severity, with a CVSS score of 3.1, published 15 April 2025.
Which products and versions are affected?: http-proxy-middleware (npm) SEMVER:introduced=1.3.0,fixed=2.0.8.
Is there a fix for CVE-2025-32996?: Yes. http-proxy-middleware (npm): upgrade to 2.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-32996 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-32996?: Check whether you run http-proxy-middleware (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

http-proxy-middleware (npm): upgrade to 2.0.8 or later
```
npm install http-proxy-middleware@2.0.8
```

Technical details

The vulnerability exists in the fixRequestBody handler where conditional logic uses "if" statements instead of "else if", allowing the writeBody function to be executed multiple times. This double execution results in attempts to set HTTP headers after they have been sent to the client, triggering "Cannot set headers after they are sent" errors. The vulnerability was introduced in version 1.3.0 and affects versions 1.3.0-2.0.7 and 3.0.0-3.0.3. The attack vector is network-based with no authentication required; any request processed through the affected middleware can trigger the flaw. Patches are available in versions 2.0.8 and 3.0.4.

Affected products

chimurai http-proxy-middleware 1.3.0 through 2.0.7, 3.0.0 through 3.0.3

Identifiers

CVE-2025-32996
GHSA-4www-5p9h-95mh

Timeline

2025-04-15: disclosed: Vulnerability published to advisories
2025-04-09: patched: Fixed in version 2.0.8 and 3.0.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.