Ramialtai

**Name of the Vulnerable Software and Affected Versions** http-proxy-middleware versions 3.0.4 through 3.0.6 http-proxy-middleware versions prior to 4.1.1 **Description** An issue exists in the `fixRequestBody()` helper function when the outgoing `Content-Type` is set to `multipart/form-data`. The function uses `handlerFormDataBodyData()` to rebuild the request body, but it interpolates `req.body` keys and values directly into the multipart wire format without neutralizing Carriage Return (CR) and Line Feed (LF) characters. This allows an attacker to inject `r ` sequences into a value or key to close the current part and inject entirely new form parts. This leads to a request/parameter desynchronization across the trust boundary. Because the proxy's body parser treats the input as a single opaque value, any gateway-side validation performed on `req.body` may be bypassed, while the upstream backend parses the injected fields. This can result in validation or access-control bypasses, parameter tampering (such as overriding IDs or flags), and file-part injection. **Recommendations** Update to version 3.0.7 or 4.1.1. As a temporary workaround, restrict the use of the `fixRequestBody()` function when handling `multipart/form-data` content types until the update is applied.