PT-2026-50734 · Npm · Http-Proxy-Middleware
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
http-proxy-middleware versions 0.16.0 through 2.0.9
http-proxy-middleware versions 3.0.0 through 3.0.5
http-proxy-middleware versions 4.0.0 through 4.0.9
Description
An issue exists in the
router proxy-table implementation where host+path selectors use unanchored substring matching on request metadata. When a router key contains a /, the getTargetFromProxyTable() function concatenates the Host header and the request URL into a single string and checks if the configured key is a substring of that combined value. This allows an attacker to bypass routing boundaries by providing a crafted Host header that acts as a superstring match for the configured key, potentially routing requests to unintended backends. This affects the createProxyMiddleware() function when configured with host+path rules.Recommendations
Update to version 2.0.10, 3.0.6, or 4.1.0 depending on the major version in use.
As a temporary workaround, avoid using host+path selectors in the
router configuration of createProxyMiddleware() until the update is applied.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Http-Proxy-Middleware