CVE-2025-32997 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
Attackers can bypass request body parsing failures, potentially leading to inconsistent state or data manipulation in proxied requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32997?
CVE-2025-32997 is a medium-severity vulnerability in chimurai http-proxy-middleware, published on 15 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
Weakness: CWE-754
Which versions are affected by CVE-2025-32997?
4 open source packages ship an affected version, including http-proxy-middleware. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
http-proxy-middleware npm | From 1.3.0 | 2.0.9 |
http-proxy-middleware npm | From 1.3.0 | 2.0.9 |
http-proxy-middleware npm | From 3.0.0 | 3.0.5 |
http-proxy-middleware npm | From 3.0.0 | 3.0.5 |
Products include Chimurai Http-Proxy-Middleware.
How do I fix CVE-2025-32997?
Upgrade http-proxy-middleware to a fixed version for your release line: 2.0.9 or 3.0.5.
Is CVE-2025-32997 being exploited?
There is no known exploitation of CVE-2025-32997 in the wild and no public exploit code.
Other vulnerabilities in chimurai http-proxy-middleware
- CVE-2024-21536 Denial of service in http-proxy-middleware
- CVE-2026-55603 http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
- CVE-2026-55602 http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- CVE-2025-32996 http-proxy-middleware can call writeBody twice because "else if" is not used
Sources
Also known as CLEANSTART-2026-WO72522, CLSA-2026-1774657385, GHSA-9gqv-wp59-fq42, ROOT-APP-NPM-CVE-2025-32997.