Executive brief
http-proxy-middleware is a popular Node.js library used to forward HTTP requests from one server to another in web applications. A flaw in the request body handling logic allows the library to process requests even after the body parser fails, potentially leading to malformed data being sent upstream or request handling inconsistencies that could affect service integrity or enable security bypass scenarios.
Technical details
The vulnerability is an improper error handling issue (CWE-754) in the fixRequestBody function of http-proxy-middleware. When bodyParser fails during request processing, the fixRequestBody function proceeds regardless of the error state, potentially sending malformed or incomplete request bodies to the proxied upstream server. The flaw affects versions 1.3.0–2.0.8 and 3.0.0–3.0.4 and is exploitable over the network without authentication or user interaction. An attacker can craft requests that trigger parser failures, causing subsequent request forwarding to proceed with corrupted or incomplete data, leading to integrity issues or bypass of intended request validation. Fixes are available in versions 2.0.9 and 3.0.5, which add proper readableLength checks to validate the request body before forwarding.
Affected products
- chimurai http-proxy-middleware 1.3.0 through 2.0.8 and 3.0.0 through 3.0.4
Timeline
- 2025-04-15: disclosed: Vulnerability published
- 2025-04-10: patched: Fix merged in pull request #1096
- 2025-04-15: advisory: GHSA-9gqv-wp59-fq42 and CVE-2025-32997 published