AIKIDO-2026-286573
http-proxy-middleware is vulnerable to Server-Side Request Forgery (SSRF)
65
Medium Risk
This Affects:
http-proxy-middlewareTL;DR
The router object matcher in http-proxy-middleware selects upstream targets from a proxy table using substring checks over the request host and URL. A crafted Host header can match a shorter configured host+path key and forward the request to an unintended configured upstream. Before the fix, requests could be proxied to the wrong backend in multi-host router tables. The patch enforces exact host equality and prefix-only path matching for host+path keys.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and configure the router option as an object mapping hosts or host+path keys to upstream targets.
Background info
http-proxy-middleware is vulnerable to Server-Side Request Forgery (SSRF) in versions 3.0.0 - 3.0.5 and 4.0.0 - 4.0.0.
How to fix this
Upgrade the http-proxy-middleware library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant