PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55602 chimurai CVE debrief

CVE-2026-55602 is a vulnerability in http-proxy-middleware, a node.js http-proxy middleware. The vulnerability allows a crafted Host header to route a request to an unintended backend. The issue exists from version 0.16.0 until 2.0.10, 3.0.6, and 4.1.0. The vulnerability is fixed in versions 2.0.10, 3.0.6, and 4.1.0. A crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability has a CVSS score of 6.9 and a severity of MEDIUM.

Vendor
chimurai
Product
http-proxy-middleware
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-26
Advisory published
2026-06-22
Advisory updated
2026-06-26

Who should care

Developers and administrators using http-proxy-middleware in their applications should be aware of this vulnerability. The vulnerability can be exploited by sending a crafted Host header, which can route a request to an unintended backend. Users of http-proxy-middleware should update to a fixed version to prevent exploitation.

Technical summary

The http-proxy-middleware vulnerability exists due to unanchored substring matching on attacker-controlled request metadata. The host+path implementation uses a flawed matching mechanism, allowing a crafted Host header to route a request to an unintended backend. The vulnerability affects versions 0.16.0 until 2.0.10, 3.0.6, and 4.1.0. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

This vulnerability has a MEDIUM severity and a CVSS score of 6.9. It is recommended to update to a fixed version of http-proxy-middleware to prevent exploitation.

Recommended defensive actions

  • Update to version 2.0.10, 3.0.6, or 4.1.0 of http-proxy-middleware
  • Review and update affected applications using http-proxy-middleware
  • Monitor for suspicious activity and implement compensating controls
  • Verify and validate Host headers in incoming requests
  • Implement additional security measures to prevent exploitation

Evidence notes

The vulnerability is documented in the CVE record and the NVD detail page. The source item URL provides additional information on the vulnerability. The mitigation or vendor reference provides information on the fixed versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55602 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55602

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55602 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55602

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.