Executive brief
http-proxy-middleware is a popular tool used by Node.js applications to route web traffic to different backend servers. A flaw in how it handles routing rules allows an attacker to bypass intended traffic restrictions by providing a specially crafted web request. This could result in unauthorized access to internal backend services that were meant to be protected or isolated.
Technical details
A vulnerability exists in http-proxy-middleware's 'router' configuration when using host+path selectors. The implementation in 'getTargetFromProxyTable()' concatenates the attacker-controlled Host header and request URL, then performs a substring match using 'indexOf()' against the configured routing keys. Because the match is unanchored, an attacker can provide a Host header that is a superstring of a valid routing key (e.g., 'evillocalhost:3000' matching 'localhost:3000'). This allows an attacker to force the proxy to route requests to an unintended backend. The issue is fixed in versions 2.0.10, 3.0.6, and 4.1.0.
Affected products
- chimurai http-proxy-middleware >= 0.16.0 < 2.0.10, >= 3.0.0 < 3.0.6, >= 4.0.0 < 4.1.0
Timeline
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD