PT-2025-16284 · Unknown · Http-Proxy-Middleware

Chimurai · Published 2025-04-15 · Updated 2025-10-21 · CVE-2025-32997

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions http-proxy-middleware versions 2.0.9 and earlier, 3.x versions prior to 3.0.5

Description The issue arises when fixRequestBody proceeds even if bodyParser has failed. This can lead to potential security risks.

Recommendations For versions prior to 2.0.9, update to version 2.0.9 or later. For 3.x versions prior to 3.0.5, update to version 3.0.5 or later. As a temporary workaround, consider disabling the fixRequestBody function until a patch is available.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2025-32997

GHSA-9GQV-WP59-FQ42

Affected Products

Http-Proxy-Middleware

References · 12

• https://github.com/chimurai/http-proxy-middleware/commit/1bdccbeec243850f1d2bb50ea0ff2151e725d67e · Patch
• https://osv.dev/vulnerability/CVE-2025-32997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32997 · Security Note
• https://osv.dev/vulnerability/GHSA-9gqv-wp59-fq42 · Vendor Advisory
• https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5 · Note
• https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9 · Note
• https://github.com/chimurai/http-proxy-middleware/pull/1096 · Note
• https://github.com/chimurai/http-proxy-middleware · Note
• https://twitter.com/CVEnew/status/1911991012278280489 · Twitter Post
• https://t.me/cvedetector/22910 · Telegram Post
• https://t.me/cvetracker/21589 · Telegram Post
• https://t.me/cveNotify/139617 · Telegram Post