The vulnerability lies in the http-proxy-middleware Node.js library, in the helper function fixRequestBody. It rebuilds multipart/form-data request bodies without neutralizing CR/LF characters. When a request contains a CRLF embedded in a key or value, the proxy terminates the current form part and injects a new part, leading to a desynchronization between what the proxy’s upstream validation sees and what the downstream backend actually receives. This can allow attackers to bypass input validation or append malicious parameters to the request body.

The issue affects chimurai/http-proxy-middleware versions 3.0.4 through 3.0.7 and 4.1.1. The problem occurs only when fixRequestBody is used to re-emit multipart/form-data bodies.

The CVSS score of 7.5 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by sending a crafted multipart/form-data request through the proxy to an internal service, without requiring privileged access. The injected form part may alter downstream processing or introduce malicious payloads if the backend forwards or executes the data.