CVE-2026-55602

Name of the Vulnerable Software and Affected Versions http-proxy-middleware versions 0.16.0 through 2.0.9 http-proxy-middleware versions 3.0.0 through 3.0.5 http-proxy-middleware versions 4.0.0 through 4.0.9

Description An issue exists in the router proxy-table implementation where host+path selectors use unanchored substring matching on request metadata. When a router key contains a /, the getTargetFromProxyTable() function concatenates the Host header and the request URL into a single string and checks if the configured key is a substring of that combined value. This allows an attacker to bypass routing boundaries by providing a crafted Host header that acts as a superstring match for the configured key, potentially routing requests to unintended backends. This affects the createProxyMiddleware() function when configured with host+path rules.

Recommendations Update to version 2.0.10, 3.0.6, or 4.1.0 depending on the major version in use. As a temporary workaround, avoid using host+path selectors in the router configuration of createProxyMiddleware() until the update is applied.