Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the http-proxy-middleware library and is a CRLF injection vulnerability. The root cause is the improper handling of multipart/form-data request bodies in the fixRequestBody function. Specifically, the handlerFormDataBodyData function, which is called by fixRequestBody, does not sanitize or escape CR/LF characters in the form field values. This allows an attacker to inject new form fields by crafting a malicious request body. The vulnerability is triggered when an application uses fixRequestBody to re-stream a request body that has been parsed by a non-multipart parser (e.g., express.json() or express.urlencoded()) and the outgoing request is set to multipart/form-data. The provided patch remediates this by adding a check for CR/LF characters and throwing an error if they are present, and also by escaping double quotes in the field names.
fixRequestBodysrc/handlers/fix-request-body.ts
handlerFormDataBodyDatasrc/handlers/fix-request-body.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| http-proxy-middleware | npm | >= 3.0.4, < 3.0.7 | 3.0.7 |
| http-proxy-middleware | npm | >= 4.0.0, < 4.1.1 | 4.1.1 |