What is GHSA-9gqv-wp59-fq42?

GHSA-9gqv-wp59-fq42 is a security advisory published by GitHub Security Advisories with Medium severity. http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

Which CVE IDs does GHSA-9gqv-wp59-fq42 cover?

GHSA-9gqv-wp59-fq42 covers the following CVE IDs: CVE-2025-32997. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9gqv-wp59-fq42?

GHSA-9gqv-wp59-fq42 has a CVSS v3 base score of 4.0, published by GitHub Security Advisories.

Which products are affected by GHSA-9gqv-wp59-fq42?

GHSA-9gqv-wp59-fq42 affects 2 products, including: npm/http-proxy-middleware:\u003e= 3.0.0, \u003c 3.0.5; npm/http-proxy-middleware:\u003e= 1.3.0, \u003c 2.0.9.

GHSA-9gqv-wp59-fq42MediumCVSS 4.0

http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

Vendor

GitHub Security Advisories

Published

April 15, 2025

Last Modified

April 28, 2025

🔗 CVE IDs covered (1)

CVE-2025-32997 →

📋 Description

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

🎯 Affected products2

npm/http-proxy-middleware:>= 3.0.0, < 3.0.5
npm/http-proxy-middleware:>= 1.3.0, < 2.0.9

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-32997
https://github.com/chimurai/http-proxy-middleware/pull/1096
https://github.com/chimurai/http-proxy-middleware/commit/1bdccbeec243850f1d2bb50ea0ff2151e725d67e
https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9
https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5
https://github.com/advisories/GHSA-9gqv-wp59-fq42