Is CVE-2025-32997 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-32997 being exploited in the wild.

How severe is CVE-2025-32997?

Low severity, with a CVSS score of 3.1, published 15 April 2025.

Which products and versions are affected?

http-proxy-middleware (npm) SEMVER:introduced=1.3.0,fixed=2.0.9.

Is there a fix for CVE-2025-32997?

Yes. http-proxy-middleware (npm): upgrade to 2.0.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-32997 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-32997?

Check whether you run http-proxy-middleware (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-32997: http-proxy-middleware fixRequestBody error handling bypass

CVE-2025-32997 · Severity: low · CVSS 3.1 · Published 2025-04-15

http-proxy-middleware is a popular Node.js library used to forward HTTP requests from one server to another in web applications. A flaw in the request body handling logic allows the library to process requests even after the body parser fails, potentially leading to malformed data being sent upstream or request handling inconsistencies that could affect service integrity or enable security bypass scenarios.

Technologies: http-proxy-middleware (npm). Vendors: npm.

Quick answers

Is CVE-2025-32997 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-32997 being exploited in the wild.
How severe is CVE-2025-32997?: Low severity, with a CVSS score of 3.1, published 15 April 2025.
Which products and versions are affected?: http-proxy-middleware (npm) SEMVER:introduced=1.3.0,fixed=2.0.9.
Is there a fix for CVE-2025-32997?: Yes. http-proxy-middleware (npm): upgrade to 2.0.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-32997 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-32997?: Check whether you run http-proxy-middleware (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

http-proxy-middleware (npm): upgrade to 2.0.9 or later
```
npm install http-proxy-middleware@2.0.9
```

Technical details

The vulnerability is an improper error handling issue (CWE-754) in the fixRequestBody function of http-proxy-middleware. When bodyParser fails during request processing, the fixRequestBody function proceeds regardless of the error state, potentially sending malformed or incomplete request bodies to the proxied upstream server. The flaw affects versions 1.3.0–2.0.8 and 3.0.0–3.0.4 and is exploitable over the network without authentication or user interaction. An attacker can craft requests that trigger parser failures, causing subsequent request forwarding to proceed with corrupted or incomplete data, leading to integrity issues or bypass of intended request validation. Fixes are available in versions 2.0.9 and 3.0.5, which add proper readableLength checks to validate the request body before forwarding.

Affected products

chimurai http-proxy-middleware 1.3.0 through 2.0.8 and 3.0.0 through 3.0.4

Identifiers

CVE-2025-32997
GHSA-9gqv-wp59-fq42

Timeline

2025-04-15: disclosed: Vulnerability published
2025-04-10: patched: Fix merged in pull request #1096
2025-04-15: advisory: GHSA-9gqv-wp59-fq42 and CVE-2025-32997 published

References

https://github.com/chimurai/http-proxy-middleware/pull/1096

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.