CVE-2026-55603

Name of the Vulnerable Software and Affected Versions http-proxy-middleware versions 3.0.4 through 3.0.6 http-proxy-middleware versions prior to 4.1.1

Description An issue exists in the fixRequestBody() helper function when the outgoing Content-Type is set to multipart/form-data. The function uses handlerFormDataBodyData() to rebuild the request body, but it interpolates req.body keys and values directly into the multipart wire format without neutralizing Carriage Return (CR) and Line Feed (LF) characters. This allows an attacker to inject r sequences into a value or key to close the current part and inject entirely new form parts.

This leads to a request/parameter desynchronization across the trust boundary. Because the proxy's body parser treats the input as a single opaque value, any gateway-side validation performed on req.body may be bypassed, while the upstream backend parses the injected fields. This can result in validation or access-control bypasses, parameter tampering (such as overriding IDs or flags), and file-part injection.

Recommendations Update to version 3.0.7 or 4.1.1. As a temporary workaround, restrict the use of the fixRequestBody() function when handling multipart/form-data content types until the update is applied.