Vulnerability	Vulnerable Version
M CRLF Injection Affected versions of this package are vulnerable to CRLF Injection via the `fixRequestBody` function. An attacker can inject or override multipart form fields, potentially bypassing gateway-side validation or access controls, by supplying crafted input containing carriage return and line feed characters in field names or values. This can result in the backend receiving manipulated parameters not visible to the gateway, enabling unauthorized actions or parameter tampering. Note: This is only exploitable if the proxy application uses a non-multipart parser to populate the request body, the outgoing request is sent as multipart/form-data, and the application calls `fixRequestBody` with attacker-controlled input. How to fix CRLF Injection? Upgrade `http-proxy-middleware` to version 3.0.7, 4.1.1 or higher.	>=3.0.4 <3.0.7>=4.0.0 <4.1.1

CRLF Injection

Affected versions of this package are vulnerable to CRLF Injection via the fixRequestBody function. An attacker can inject or override multipart form fields, potentially bypassing gateway-side validation or access controls, by supplying crafted input containing carriage return and line feed characters in field names or values. This can result in the backend receiving manipulated parameters not visible to the gateway, enabling unauthorized actions or parameter tampering.

Note:

This is only exploitable if the proxy application uses a non-multipart parser to populate the request body, the outgoing request is sent as multipart/form-data, and the application calls fixRequestBody with attacker-controlled input.

How to fix CRLF Injection?

Upgrade http-proxy-middleware to version 3.0.7, 4.1.1 or higher.

>=3.0.4 <3.0.7>=4.0.0 <4.1.1

Go back to all versions of this package