CVE-2025-32997: Http-proxy-middleware DOS Vulnerability

CVE-2025-32997 Overview

CVE-2025-32997 is an input validation vulnerability affecting the http-proxy-middleware npm package, a widely-used Node.js middleware for proxying HTTP requests. The vulnerability exists in the fixRequestBody function, which proceeds to process request bodies even when the bodyParser middleware has failed. This improper check for exceptional conditions (CWE-754) can allow attackers to manipulate request integrity by sending malformed or unexpected body content through the proxy.

Critical Impact

Attackers can bypass body parsing validation checks, potentially sending malformed or malicious request bodies to backend services through the proxy middleware, compromising request integrity.

Affected Products

• chimurai http-proxy-middleware versions before 2.0.9
• chimurai http-proxy-middleware 3.x versions before 3.0.5

Discovery Timeline

• 2025-04-15 - CVE-2025-32997 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-32997

Vulnerability Analysis

The vulnerability resides in the fixRequestBody function within src/handlers/fix-request-body.ts. This function is designed to handle proxied request bodies when the bodyParser middleware is involved in the request processing pipeline. However, in vulnerable versions, the function fails to verify whether the bodyParser successfully processed the incoming request before proceeding with body manipulation.

When bodyParser encounters an error (such as malformed JSON, invalid encoding, or content exceeding size limits), it may leave the request in an inconsistent state where req.readableLength is not zero. The vulnerable code does not check this condition and continues processing, which can lead to request integrity issues where malformed or partially parsed content is forwarded to backend services.

This type of improper check for exceptional conditions can be exploited by network-based attackers without authentication or user interaction, allowing them to send malicious payloads through the proxy to downstream services.

Root Cause

The root cause is the absence of a validation check for req.readableLength in the fixRequestBody function. When bodyParser fails to fully consume and parse the request body, req.readableLength will be non-zero, indicating that unread data remains in the stream. The vulnerable code did not verify this condition before processing, allowing requests with failed body parsing to continue through the proxy.

Attack Vector

An attacker can exploit this vulnerability remotely over the network by:

1. Sending HTTP requests with malformed body content that causes bodyParser to fail
2. The fixRequestBody function proceeds despite the parsing failure
3. Malformed or unexpected content is forwarded to backend services
4. Backend services may process the malicious payload, leading to potential integrity violations

The attack requires no authentication and no user interaction, making it accessible to unauthenticated remote attackers.

// Vulnerable code in src/handlers/fix-request-body.ts
// Before the fix, there was no check for bodyParser failure
export function fixRequestBody<TReq extends BodyParserLikeRequest = BodyParserLikeRequest>(
  proxyReq: http.ClientRequest,
  req: TReq,
  res: http.ServerResponse<http.IncomingMessage>,
  options: Options,
): void {
  // Missing check: req.readableLength !== 0 (bodyParser failure)
  const requestBody = req.body;
  // ... continues processing even if bodyParser failed
}

// Fixed code adds the critical validation check
export function fixRequestBody<TReq extends BodyParserLikeRequest = BodyParserLikeRequest>(
  proxyReq: http.ClientRequest,
  req: TReq,
): void {
  // skip fixRequestBody() when req.readableLength not 0 (bodyParser failure)
  if (req.readableLength !== 0) {
    return;
  }

  const requestBody = req.body;
  // ... safely continues only if bodyParser succeeded
}

Source: GitHub Commit

Detection Methods for CVE-2025-32997

Indicators of Compromise

• Unusual or malformed HTTP request bodies being forwarded to backend services
• Backend application logs showing parsing errors for requests that passed through the proxy
• Increased error rates in bodyParser middleware logs coupled with successful downstream requests
• Unexpected content-type mismatches in proxied requests

Detection Strategies

• Audit package.json and package-lock.json files to identify vulnerable versions of http-proxy-middleware (versions < 2.0.9 or 3.x < 3.0.5)
• Run npm audit or yarn audit to detect known vulnerabilities in project dependencies
• Implement request validation at backend services to detect malformed bodies that bypass proxy validation
• Deploy web application firewalls (WAF) to detect and block anomalous request patterns

Monitoring Recommendations

• Monitor for discrepancies between bodyParser error logs and successful proxy forwards
• Implement logging at the proxy layer to capture requests where req.readableLength indicates unprocessed data
• Set up alerts for unusual patterns in request body content or encoding errors
• Track dependency versions in CI/CD pipelines to ensure vulnerable packages are flagged during builds

How to Mitigate CVE-2025-32997

Immediate Actions Required

• Update http-proxy-middleware to version 2.0.9 or later for the 2.x branch
• Update http-proxy-middleware to version 3.0.5 or later for the 3.x branch
• Run npm update http-proxy-middleware or yarn upgrade http-proxy-middleware to apply the fix
• Review application logs for any signs of exploitation attempts

Patch Information

The vulnerability has been addressed in the following releases:

• Version 2.0.9: GitHub Release v2.0.9
• Version 3.0.5: GitHub Release v3.0.5

The fix is documented in Pull Request #1096 and implemented in commit 1bdccbe. The patch adds a check for req.readableLength !== 0 to skip body processing when bodyParser has failed.

Workarounds

• If immediate patching is not possible, implement custom middleware before http-proxy-middleware to validate req.readableLength and reject requests where bodyParser has failed
• Add backend validation to reject requests with malformed or unexpected body content
• Configure WAF rules to enforce strict content-type and body format validation
• Consider temporarily disabling body parsing features if not required for your application

# Update http-proxy-middleware to patched version
npm update http-proxy-middleware

# Or specify exact version in package.json
npm install http-proxy-middleware@^3.0.5

# Verify the installed version
npm list http-proxy-middleware