CVE-2026-55602: http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-22 · updated 2026-10-25
Weakness: CWE-20

Description

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.

Affected products

chimurai http-proxy-middleware: from 0.16.0 before 2.0.10; from 3.0.0 before 3.0.6; from 4.0.0 before 4.1.0 — fixed in 2.0.10, 3.0.6, 4.1.0
Npm Http-Proxy-Middleware: from 3.0.0 before 3.0.6; from 4.0.0 before 4.1.0; from 0.16.0 before 2.0.10 — fixed in 3.0.6, 4.1.0, 2.0.10

How to fix

Upgrade to a fixed version: chimurai http-proxy-middleware 2.0.10, 3.0.6, 4.1.0; Npm Http-Proxy-Middleware 3.0.6, 4.1.0, 2.0.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-55602 or the next vulnerability affects your stack