CVE-2025-32996: Http-proxy-middleware DOS Vulnerability

CVE-2025-32996 Overview

CVE-2025-32996 is a vulnerability in the popular http-proxy-middleware Node.js package where the writeBody function can be called twice due to missing "else if" logic in the code flow. This middleware is widely used in JavaScript applications to proxy HTTP requests, making it a significant concern for web developers and organizations using affected versions.

Critical Impact

Applications using vulnerable versions of http-proxy-middleware may experience denial of service conditions when the writeBody function is invoked twice, potentially causing service disruption in production environments.

Affected Products

• chimurai http-proxy-middleware versions before 2.0.8
• chimurai http-proxy-middleware 3.x versions before 3.0.4

Discovery Timeline

• 2025-04-15 - CVE-2025-32996 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-32996

Vulnerability Analysis

This vulnerability stems from a control flow logic error (CWE-670: Always-Incorrect Control Flow Implementation) in the http-proxy-middleware package. The issue occurs because the code fails to use proper "else if" conditional branching, allowing the writeBody function to be called multiple times during request processing. When processing proxied requests, this duplicate invocation can lead to unexpected behavior, resource consumption, and potential service disruption.

The vulnerability is exploitable over the network without requiring authentication or user interaction, making it accessible to remote attackers who can send crafted requests to applications using the vulnerable middleware.

Root Cause

The root cause is an improper conditional statement structure in the middleware's request handling code. Instead of using mutually exclusive "else if" branches to ensure writeBody is called only once, the code uses separate "if" statements that allow multiple execution paths to invoke the function. This represents a classic control flow implementation error where the developer's intent was not properly reflected in the code logic.

Attack Vector

An attacker can exploit this vulnerability by sending HTTP requests to applications using the vulnerable http-proxy-middleware. When the middleware processes these requests, the flawed conditional logic may cause writeBody to be invoked twice, leading to resource exhaustion and potential denial of service. Since the attack vector is network-based and requires no privileges or user interaction, any publicly accessible application using vulnerable versions is at risk.

The vulnerability exists in the request body handling pathway, where specific request characteristics can trigger both conditional branches that call writeBody. For detailed technical analysis, refer to the GitHub Pull Request Discussion.

Detection Methods for CVE-2025-32996

Indicators of Compromise

• Unusual HTTP proxy error messages or exceptions in application logs related to body writing operations
• Increased memory consumption in Node.js processes running http-proxy-middleware
• Application crashes or restarts associated with proxy request handling

Detection Strategies

• Audit your package.json and package-lock.json files to identify http-proxy-middleware versions before 2.0.8 or 3.x versions before 3.0.4
• Use npm audit or yarn audit commands to automatically detect vulnerable dependencies
• Implement software composition analysis (SCA) tools in your CI/CD pipeline to flag vulnerable packages

Monitoring Recommendations

• Monitor application performance metrics for unusual CPU or memory spikes during proxy operations
• Enable detailed logging for proxy middleware to capture anomalous request patterns
• Set up alerts for Node.js process crashes or unhandled exceptions in production environments

How to Mitigate CVE-2025-32996

Immediate Actions Required

• Upgrade http-proxy-middleware to version 2.0.8 or later for 2.x branch users
• Upgrade http-proxy-middleware to version 3.0.4 or later for 3.x branch users
• Review and test applications after upgrade to ensure compatibility with the patched versions

Patch Information

The maintainers have released patched versions that address this vulnerability by implementing proper "else if" conditional logic. The fix ensures that writeBody is called exactly once during request processing.

• Version 2.0.8: GitHub Release v2.0.8
• Version 3.0.4: GitHub Release v3.0.4
• Commit: GitHub Commit Update

Workarounds

• If immediate upgrade is not possible, consider implementing rate limiting on endpoints using the proxy middleware to reduce potential impact
• Monitor proxy-related endpoints more closely for signs of exploitation
• Evaluate alternative proxy solutions temporarily if the vulnerability poses significant risk to your environment

# Upgrade http-proxy-middleware to patched version
npm update http-proxy-middleware

# Or specify exact version for 2.x branch
npm install http-proxy-middleware@2.0.8

# Or specify exact version for 3.x branch
npm install http-proxy-middleware@3.0.4

# Verify installed version
npm list http-proxy-middleware