-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description states that fixRequestBody proceeds even if bodyParser has failed. The provided commit 1bdccbeec243850f1d2bb50ea0ff2151e725d67e directly addresses this by adding a condition at the beginning of the fixRequestBody function in src/handlers/fix-request-body.ts. This new condition checks req.readableLength and returns if it's not zero, which signifies that bodyParser did not successfully parse the entire request body, or failed. Before this change, fixRequestBody would continue its execution path regardless of bodyParser's success, making it the function where the vulnerability manifested. The test file test/unit/fix-request-body.spec.ts also shows changes related to this logic, specifically in the test case it('should not fixRequestBody() when there bodyParser fails'), confirming that the behavior of fixRequestBody under bodyParser failure conditions was the focus of the fix.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| http-proxy-middleware | npm | >= 3.0.0, < 3.0.5 | 3.0.5 |
| http-proxy-middleware | npm | >= 1.3.0, < 2.0.9 | 2.0.9 |
A Semantic Attack on Google Gemini - Read the Latest Research