CVE-2025-32996 http-proxy-middleware can call writeBody twice because "else if" is not used
A logic error in http-proxy-middleware allows the response body to be written twice, potentially causing data corruption or unexpected behavior in proxied requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32996?
CVE-2025-32996 is a medium-severity vulnerability in chimurai http-proxy-middleware, published on 15 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
Weakness: CWE-670
Which versions are affected by CVE-2025-32996?
4 open source packages ship an affected version, including http-proxy-middleware. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
http-proxy-middleware npm | From 1.3.0 | 2.0.8 |
http-proxy-middleware npm | From 1.3.0 | 2.0.8 |
http-proxy-middleware npm | From 3.0.0 | 3.0.4 |
http-proxy-middleware npm | From 3.0.0 | 3.0.4 |
Products include Chimurai Http-Proxy-Middleware.
How do I fix CVE-2025-32996?
Upgrade http-proxy-middleware to a fixed version for your release line: 2.0.8 or 3.0.4.
Is CVE-2025-32996 being exploited?
There is no known exploitation of CVE-2025-32996 in the wild and no public exploit code.
Other vulnerabilities in chimurai http-proxy-middleware
- CVE-2024-21536 Denial of service in http-proxy-middleware
- CVE-2026-55603 http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
- CVE-2026-55602 http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- CVE-2025-32997 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
Sources
Also known as CLEANSTART-2026-CL11266, CLSA-2026-1784077482, GHSA-4www-5p9h-95mh, ROOT-APP-NPM-CVE-2025-32996.