CVE-2026-55602 http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
Attackers can bypass backend routing restrictions by crafting Host headers that exploit unanchored substring matching in http-proxy-middleware configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55602?
CVE-2026-55602 is a medium-severity vulnerability in chimurai http-proxy-middleware, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.
Which versions are affected by CVE-2026-55602?
6 open source packages ship an affected version, including http-proxy-middleware. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
http-proxy-middleware npm | From 0.16.0 | 2.0.10 |
http-proxy-middleware npm | From 0.16.0 | 2.0.10 |
http-proxy-middleware npm | From 3.0.0 | 3.0.6 |
http-proxy-middleware npm | From 3.0.0 | 3.0.6 |
http-proxy-middleware npm | From 4.0.0 | 4.1.0 |
http-proxy-middleware npm | From 4.0.0 | 4.1.0 |
Products include Chimurai Http-Proxy-Middleware.
How do I fix CVE-2026-55602?
Upgrade http-proxy-middleware to a fixed version for your release line: 2.0.10, 3.0.6 or 4.1.0.
Is CVE-2026-55602 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55602 exists.
Other vulnerabilities in chimurai http-proxy-middleware
- CVE-2024-21536 Denial of service in http-proxy-middleware
- CVE-2026-55603 http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
- CVE-2025-32996 http-proxy-middleware can call writeBody twice because "else if" is not used
- CVE-2025-32997 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
Sources
Also known as CLEANSTART-2026-FK52853, CLSA-2026-1784509824, CLSA-2026-1788806507, CLSA-2026-1788806602, CLSA-2026-1788806634, CLSA-2026-1788867095 and 14 more.