CVE-2026-55603 http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
Attackers can inject CRLF sequences to desynchronize multipart form data between proxy and backend, bypassing validation and modifying request fields.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55603?
CVE-2026-55603 is a high-severity vulnerability in chimurai http-proxy-middleware, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \r\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.
Weakness: CWE-93
Which versions are affected by CVE-2026-55603?
4 open source packages ship an affected version, including http-proxy-middleware. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
http-proxy-middleware npm | From 3.0.4 | 3.0.7 |
http-proxy-middleware npm | From 3.0.4 | 3.0.7 |
http-proxy-middleware npm | From 4.0.0 | 4.1.1 |
http-proxy-middleware npm | From 4.0.0 | 4.1.1 |
Products include Chimurai Http-Proxy-Middleware.
How do I fix CVE-2026-55603?
Upgrade http-proxy-middleware to a fixed version for your release line: 3.0.7 or 4.1.1.
Is CVE-2026-55603 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55603 exists.
Other vulnerabilities in chimurai http-proxy-middleware
- CVE-2024-21536 Denial of service in http-proxy-middleware
- CVE-2026-55602 http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- CVE-2025-32996 http-proxy-middleware can call writeBody twice because "else if" is not used
- CVE-2025-32997 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
Sources
Also known as ECHO-f223-e4bf-2265, GHSA-gcq2-9pq2-cxqm, MINI-4jjv-rwqw-g2j9, MINI-fh57-g8r4-chwc, MINI-fm5r-ph3h-g8qf, MINI-m846-mg27-9xxf and 3 more.