CVE-2025-32997

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-32997
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

4.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/chimurai/http-proxy-middleware/commit/1bdccbeec243850f1d2bb50ea0ff2151e725d67e Patch
https://github.com/chimurai/http-proxy-middleware/pull/1096 Issue Tracking
https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9 Release Notes
https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5 Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*
cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*
History

21 Oct 2025, 14:42

Type Values Removed Values Added
First Time Chimurai
Chimurai http-proxy-middleware
References () https://github.com/chimurai/http-proxy-middleware/commit/1bdccbeec243850f1d2bb50ea0ff2151e725d67e - () https://github.com/chimurai/http-proxy-middleware/commit/1bdccbeec243850f1d2bb50ea0ff2151e725d67e - Patch
References () https://github.com/chimurai/http-proxy-middleware/pull/1096 - () https://github.com/chimurai/http-proxy-middleware/pull/1096 - Issue Tracking
References () https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9 - () https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9 - Release Notes
References () https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5 - () https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5 - Release Notes
CPE cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*

15 Apr 2025, 18:39

Type Values Removed Values Added
Summary
  • (es) En http-proxy-middleware anterior a 2.0.9 y 3.x anterior a 3.0.5, fixRequestBody continúa incluso si bodyParser ha fallado.

15 Apr 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-15 03:15

Updated : 2025-10-21 14:42

NVD link : CVE-2025-32997

Mitre link : CVE-2025-32997

CVE.ORG link : CVE-2025-32997

JSON object : View

Products Affected

chimurai

  • http-proxy-middleware
CWE
CWE-754

Improper Check for Unusual or Exceptional Conditions