Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
chimurai http-proxy-middleware — http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
AV AC PR UI S C I A CVSS EPSS %ile KEV
N H N N C L H N 7.5 .0027 18.5 —
AFFECTED
Product Versions Fixed
http-proxy-middleware >= 3.0.4, < 3.0.7 – —
TIMELINE
Jun 16 Reserved by GitHub_M
Jun 22 EXPLOIT PUBLISHED — CVE-2026-55603 (chimurai http-proxy-middleware). Public exploit reference added.
Jun 22 Published (CNA: GitHub_M)
Description
http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \r\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 16, 2026 | Reserved | Reserved by GitHub_M |
| June 22, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-55603 (chimurai http-proxy-middleware). Public exploit reference added. |
| June 22, 2026 | Published | Published (CNA: GitHub_M) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| chimurai | http-proxy-middleware | — | >= 3.0.4, < 3.0.7 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-55603 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.