Skip to content
Fencer Intel
high 7.5

CVE-2026-55603 json

http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

published 4mo ago modified 17d ago also EUVD-2026-38349 , GHSA-gcq2-9pq2-cxqm

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \r\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.

Patch / fix

  • npm http-proxy-middleware 3.0.7, 4.1.1
  • chimurai http-proxy-middleware 3.0.7, 4.1.1

Is CVE-2026-55603 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-55603 updated cvss 7.5

http-proxy-middleware: http-proxy-middleware: Data integrity compromise via CR/LF injection

  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix available
  • Red Hat Migration Toolkit for Applications 8.1 mta/mta-ui-rhel9 1785169013
    fixed: vendor fix RHSA-2026:50300
  • Red Hat Trusted Artifact Signer 1.3 rhtas/rhtas-console-ui-rhel9 1784105894
    fixed: vendor fix RHSA-2026:42085
  • Red Hat Cryostat 4 http-proxy-middleware, cryostat-openshift-console-plugin-npm Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel8 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
    +17 more products
    Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat AMQ Broker 7 http-proxy-middleware Red Hat Ansible Automation Platform 2 automation-eda-controller, ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-27/gateway-rhel9, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-rhel9, +1 more Red Hat build of Apache Camel - HawtIO 4 http-proxy-middleware Red Hat build of Apache Camel for Spring Boot 4 http-proxy-middleware Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 http-proxy-middleware Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, grafana-loki, grafana-mssql, grafana-mysql, +10 more Red Hat Enterprise Linux 9 pcs, pcs-snmp Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 http-proxy-middleware Red Hat Migration Toolkit for Applications 8.1 mta/mta-cli-rhel9 1785171639, mta/mta-hub-rhel9 1784313347, mta/mta-rhel9-operator 1785168960, mta/mta-operator-bundle 1785177948, mta/mta-analyzer-addon-rhel9 1784900791, mta/mta-platform-addon-rhel9 1784312255, +5 more
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9
    not affected: component not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-agent-installer-ui-rhel9 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Quay 3 quay/quay-rhel8 Red Hat Trusted Artifact Signer 1.3 rhtas/rhtas-console-rhel9 1784105848 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal, ansible-automation-platform/bootc-automation-portal-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
4mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • github.com https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm http-proxy-middleware
>=3.0.4, <3.0.7
>=4.0.0, <4.1.1
3.0.7
4.1.1

Affected products

  • chimurai http-proxy-middleware

Classification

Weakness
  • CWE-93 Improper Neutralization of CRLF Sequences

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of chimurai/http-proxy-middleware published their own advisory on GitHub. Reviewed sources take precedence over it.