{"id":"EUVD-2026-38300","revision":"7e46c7cdd57f40cd9fae8faf21ad2fc2","records":[{"revision":"7e46c7cdd57f40cd9fae8faf21ad2fc2","observedAt":"2026-11-03T11:05:40.855+00:00","statement":{"source":"euvd","id":"EUVD-2026-38300","aliases":["CVE-2026-55602","GHSA-64mm-vxmg-q3vj"],"title":"http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unan…","description":"http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38300","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 22, 2026, 3:58:08 PM","dateUpdated":"Jun 23, 2026, 2:18:06 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:12070-1","title":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","vulnerabilityIds":["CVE-2025-0914","CVE-2026-12143","CVE-2026-14257","CVE-2026-17535","CVE-2026-18348","CVE-2026-18636","CVE-2026-18638","CVE-2026-18639","CVE-2026-18860","CVE-2026-27601","CVE-2026-29074","CVE-2026-41650","CVE-2026-45623","CVE-2026-49356","CVE-2026-5329","CVE-2026-53550","CVE-2026-55602","CVE-2026-56852","CVE-2026-59869","CVE-2026-6290","CVE-2026-64951","CVE-2026-64952","CVE-2026-64954","CVE-2026-65903","CVE-2026-65912","CVE-2026-65913","CVE-2026-65914","CVE-2026-67314","CVE-2026-67320","CVE-2026-6863","CVE-2026-69152","CVE-2026-69153","CVE-2026-6948","CVE-2026-73086","CVE-2026-73646","CVE-2026-73650","CVE-2026-7572","CVE-2026-7573","CVE-2026-84369","CVE-2026-84370"]},{"id":"openSUSE-SU-2026:11680-1","title":"agama-web-ui-24+0.a836cced5-52.1 on GA media","vulnerabilityIds":["CVE-2025-7783","CVE-2026-13149","CVE-2026-13676","CVE-2026-33245","CVE-2026-49356","CVE-2026-53550","CVE-2026-53632","CVE-2026-54466","CVE-2026-55602","CVE-2026-67313","CVE-2026-67315","CVE-2026-67317","CVE-2026-67319","CVE-2026-67321","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73650"]},{"id":"NCSC-2026-0431","title":"Kwetsbaarheden verholpen in IBM DataPower Gateway en onderliggende componenten","vulnerabilityIds":["CVE-2023-53781","CVE-2025-14087","CVE-2025-14512","CVE-2025-21858","CVE-2025-22105","CVE-2025-37980","CVE-2025-38015","CVE-2025-38097","CVE-2025-38180","CVE-2025-38400","CVE-2025-38405","CVE-2025-38441","CVE-2025-38470","CVE-2025-38653","CVE-2025-39766","CVE-2025-39797","CVE-2025-39866","CVE-2025-40134","CVE-2025-48431","CVE-2025-5278","CVE-2025-68183","CVE-2025-68211","CVE-2025-68214","CVE-2025-68347","CVE-2025-68366","CVE-2025-68724","CVE-2025-71066","CVE-2025-71089","CVE-2026-12143","CVE-2026-13257","CVE-2026-13258","CVE-2026-13757","CVE-2026-14269","CVE-2026-14273","CVE-2026-14496","CVE-2026-14497","CVE-2026-14502","CVE-2026-14507","CVE-2026-14508","CVE-2026-14509","CVE-2026-14888","CVE-2026-14905","CVE-2026-14988","CVE-2026-14990","CVE-2026-14991","CVE-2026-14992","CVE-2026-14999","CVE-2026-15588","CVE-2026-15762","CVE-2026-15781","CVE-2026-15784","CVE-2026-15819","CVE-2026-15822","CVE-2026-15824","CVE-2026-16111","CVE-2026-16159","CVE-2026-16161","CVE-2026-16163","CVE-2026-16164","CVE-2026-16165","CVE-2026-16167","CVE-2026-16169","CVE-2026-16170","CVE-2026-16176","CVE-2026-16177","CVE-2026-16178","CVE-2026-16179","CVE-2026-16181","CVE-2026-16182","CVE-2026-16340","CVE-2026-16439","CVE-2026-16440","CVE-2026-16441","CVE-2026-2100","CVE-2026-22979","CVE-2026-22984","CVE-2026-22990","CVE-2026-23002","CVE-2026-23060","CVE-2026-23110","CVE-2026-23204","CVE-2026-23209","CVE-2026-23216","CVE-2026-23243","CVE-2026-23270","CVE-2026-23392","CVE-2026-23455","CVE-2026-2391","CVE-2026-31411","CVE-2026-31419","CVE-2026-31488","CVE-2026-31508","CVE-2026-31532","CVE-2026-31581","CVE-2026-31607","CVE-2026-31613","CVE-2026-31669","CVE-2026-31677","CVE-2026-31684","CVE-2026-31685","CVE-2026-33845","CVE-2026-33846","CVE-2026-3832","CVE-2026-3833","CVE-2026-4046","CVE-2026-41254","CVE-2026-41602","CVE-2026-41606","CVE-2026-41607","CVE-2026-42009","CVE-2026-42010","CVE-2026-42011","CVE-2026-42012","CVE-2026-42013","CVE-2026-42014","CVE-2026-42015","CVE-2026-43027","CVE-2026-43037","CVE-2026-43038","CVE-2026-43056","CVE-2026-43074","CVE-2026-43116","CVE-2026-43125","CVE-2026-43163","CVE-2026-43190","CVE-2026-43198","CVE-2026-43260","CVE-2026-43284","CVE-2026-43303","CVE-2026-43329","CVE-2026-43499","CVE-2026-43501","CVE-2026-43868","CVE-2026-43870","CVE-2026-4437","CVE-2026-4438","CVE-2026-45852","CVE-2026-46054","CVE-2026-46086","CVE-2026-46116","CVE-2026-46173","CVE-2026-46181","CVE-2026-46242","CVE-2026-46259","CVE-2026-46300","CVE-2026-46331","CVE-2026-46333","CVE-2026-46917","CVE-2026-46968","CVE-2026-47010","CVE-2026-47021","CVE-2026-47027","CVE-2026-47059","CVE-2026-47063","CVE-2026-48144","CVE-2026-48145","CVE-2026-5260","CVE-2026-52923","CVE-2026-52991","CVE-2026-53006","CVE-2026-53009","CVE-2026-53131","CVE-2026-53189","CVE-2026-53264","CVE-2026-53266","CVE-2026-5419","CVE-2026-5450","CVE-2026-55602","CVE-2026-55603","CVE-2026-55968","CVE-2026-55970","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58016","CVE-2026-58662","CVE-2026-59879","CVE-2026-59880","CVE-2026-60147","CVE-2026-60589","CVE-2026-61308","CVE-2026-63913","CVE-2026-63952","CVE-2026-64017","CVE-2026-64530","CVE-2026-64560","CVE-2026-70906","CVE-2026-70907","CVE-2026-74581","CVE-2026-82417","CVE-2026-82562","CVE-2026-83605","CVE-2026-83607","CVE-2026-83608","CVE-2026-83613","CVE-2026-83614","CVE-2026-83615","CVE-2026-83616","CVE-2026-83619"]},{"id":"WID-SEC-W-2026-3623","title":"IBM DataPower Gateway: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2023-53781","CVE-2025-14087","CVE-2025-14512","CVE-2025-21858","CVE-2025-22105","CVE-2025-37980","CVE-2025-38015","CVE-2025-38097","CVE-2025-38180","CVE-2025-38400","CVE-2025-38405","CVE-2025-38441","CVE-2025-38470","CVE-2025-38653","CVE-2025-39766","CVE-2025-39797","CVE-2025-39866","CVE-2025-40134","CVE-2025-48431","CVE-2025-5278","CVE-2025-68183","CVE-2025-68211","CVE-2025-68214","CVE-2025-68347","CVE-2025-68366","CVE-2025-68724","CVE-2025-71066","CVE-2025-71089","CVE-2026-12143","CVE-2026-13257","CVE-2026-13258","CVE-2026-13757","CVE-2026-14269","CVE-2026-14273","CVE-2026-14496","CVE-2026-14497","CVE-2026-14502","CVE-2026-14507","CVE-2026-14508","CVE-2026-14509","CVE-2026-14888","CVE-2026-14905","CVE-2026-14988","CVE-2026-14990","CVE-2026-14991","CVE-2026-14992","CVE-2026-14999","CVE-2026-15588","CVE-2026-15762","CVE-2026-15781","CVE-2026-15784","CVE-2026-15819","CVE-2026-15822","CVE-2026-15824","CVE-2026-16111","CVE-2026-16159","CVE-2026-16161","CVE-2026-16163","CVE-2026-16164","CVE-2026-16165","CVE-2026-16167","CVE-2026-16169","CVE-2026-16170","CVE-2026-16176","CVE-2026-16177","CVE-2026-16178","CVE-2026-16179","CVE-2026-16181","CVE-2026-16182","CVE-2026-16340","CVE-2026-16439","CVE-2026-16440","CVE-2026-16441","CVE-2026-2100","CVE-2026-22979","CVE-2026-22984","CVE-2026-22990","CVE-2026-23002","CVE-2026-23060","CVE-2026-23110","CVE-2026-23204","CVE-2026-23209","CVE-2026-23216","CVE-2026-23243","CVE-2026-23270","CVE-2026-23392","CVE-2026-23455","CVE-2026-2391","CVE-2026-31411","CVE-2026-31419","CVE-2026-31488","CVE-2026-31508","CVE-2026-31532","CVE-2026-31581","CVE-2026-31607","CVE-2026-31613","CVE-2026-31669","CVE-2026-31677","CVE-2026-31684","CVE-2026-31685","CVE-2026-33845","CVE-2026-33846","CVE-2026-3832","CVE-2026-3833","CVE-2026-4046","CVE-2026-41254","CVE-2026-41602","CVE-2026-41606","CVE-2026-41607","CVE-2026-42009","CVE-2026-42010","CVE-2026-42011","CVE-2026-42012","CVE-2026-42013","CVE-2026-42014","CVE-2026-42015","CVE-2026-43027","CVE-2026-43037","CVE-2026-43038","CVE-2026-43056","CVE-2026-43074","CVE-2026-43116","CVE-2026-43125","CVE-2026-43163","CVE-2026-43190","CVE-2026-43198","CVE-2026-43260","CVE-2026-43284","CVE-2026-43303","CVE-2026-43329","CVE-2026-43499","CVE-2026-43501","CVE-2026-43868","CVE-2026-43870","CVE-2026-4437","CVE-2026-4438","CVE-2026-45852","CVE-2026-46054","CVE-2026-46086","CVE-2026-46116","CVE-2026-46173","CVE-2026-46181","CVE-2026-46242","CVE-2026-46259","CVE-2026-46300","CVE-2026-46331","CVE-2026-46333","CVE-2026-46917","CVE-2026-46968","CVE-2026-47010","CVE-2026-47021","CVE-2026-47027","CVE-2026-47059","CVE-2026-47063","CVE-2026-48144","CVE-2026-48145","CVE-2026-5260","CVE-2026-52923","CVE-2026-52991","CVE-2026-53006","CVE-2026-53009","CVE-2026-53131","CVE-2026-53189","CVE-2026-53264","CVE-2026-53266","CVE-2026-5419","CVE-2026-5450","CVE-2026-55602","CVE-2026-55603","CVE-2026-55968","CVE-2026-55970","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58016","CVE-2026-58662","CVE-2026-59879","CVE-2026-59880","CVE-2026-60147","CVE-2026-60589","CVE-2026-61308","CVE-2026-63913","CVE-2026-63952","CVE-2026-64017","CVE-2026-64530","CVE-2026-64560","CVE-2026-70906","CVE-2026-70907","CVE-2026-74581","CVE-2026-82417","CVE-2026-82562","CVE-2026-83605","CVE-2026-83607","CVE-2026-83608","CVE-2026-83613","CVE-2026-83614","CVE-2026-83615","CVE-2026-83616","CVE-2026-83619"]},{"id":"openSUSE-SU-2026:21448-1","title":"Security update for agama-web-ui","vulnerabilityIds":["CVE-2025-7783","CVE-2026-12143","CVE-2026-13149","CVE-2026-13311","CVE-2026-13676","CVE-2026-27601","CVE-2026-40181","CVE-2026-49356","CVE-2026-53550","CVE-2026-53632","CVE-2026-54466","CVE-2026-54490","CVE-2026-55602"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-38300","identifiers":["EUVD-2026-38300","CVE-2026-55602","GHSA-64mm-vxmg-q3vj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}