{"id":"CVE-2026-55602","revision":"e42da210b40f4d18aabe3fb7fc7e6407","records":[{"revision":"e42da210b40f4d18aabe3fb7fc7e6407","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55602","aliases":[],"title":"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass","description":"http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.","state":0,"publishedAt":"2026-06-22T15:58:08.699+00:00","modifiedAt":"2026-06-23T14:18:06.403+00:00","affected":[{"ecosystem":"Vendor product","name":"http-proxy-middleware","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"chimurai\",\n                    \"product\": \"http-proxy-middleware\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 4.0.0, < 4.1.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.0.0, < 3.0.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 0.16.0, < 2.0.10\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55602","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55602","identifiers":["CVE-2026-55602"]},"retained":false,"historicalAffected":[]}],"coverage":[]}