CVE-2026-55603

http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

Published Jun 22, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \r\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.

Analysis

Technical impact

The vulnerability lies in the http-proxy-middleware Node.js library, in the helper function fixRequestBody. It rebuilds multipart/form-data request bodies without neutralizing CR/LF characters. When a request contains a CRLF embedded in a key or value, the proxy terminates the current form part and injects a new part, leading to a desynchronization between what the proxy’s upstream validation sees and what the downstream backend actually receives. This can allow attackers to bypass input validation or append malicious parameters to the request body.

Affected Systems

The issue affects chimurai/http-proxy-middleware versions 3.0.4 through 3.0.7 and 4.1.1. The problem occurs only when fixRequestBody is used to re-emit multipart/form-data bodies.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by sending a crafted multipart/form-data request through the proxy to an internal service, without requiring privileged access. The injected form part may alter downstream processing or introduce malicious payloads if the backend forwards or executes the data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

chimurai

http-proxy-middleware

affected

Version	Status	Constraints
`>= 3.0.4, < 3.0.7`	affected	—
`>= 4.0.0, < 4.1.1`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:chimurai:http-proxy-middleware::::::::
	cpe:2.3:a:chimurai:http-proxy-middleware::::::::

No data.

Vendor Product Versions

Chimurai

Http-proxy-middleware

Version	Status	Scheme	Platform
`[3.0.4,3.0.7)`	affected	semver	—
`[4.0.0,4.1.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to http-proxy-middleware v3.0.7 or v4.1.1 or later, where the CRLF filtering logic has been fixed.
If an upgrade is not feasible, avoid using fixRequestBody when handling multipart/form-data or implement a custom body reassembly that properly escapes or filters CR/LF characters.
Ensure downstream services perform independent validation of raw multipart/form-data, rather than relying solely on the proxy’s parsed representation.

Generated by OpenCVE AI on June 22, 2026 at 22:23 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-gcq2-9pq2-cxqm	http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.286% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm
https://nvd.nist.gov/vuln/detail/CVE-2026-55603
https://www.cve.org/CVERecord?id=CVE-2026-55603

History

Jun 29, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-55603 https://www.cve.org/CVERecord?id=CVE-2026-55603
Metrics	threat_severity `None`	threat_severity `Moderate`

Jun 23, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 23, 2026 12:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Chimurai Chimurai http-proxy-middleware
Vendors & Products		Chimurai Chimurai http-proxy-middleware

Jun 22, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \r\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.
Title		http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
Weaknesses		CWE-93
References		https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N'}`