CVE-2026-55602: http-proxy-middleware SSRF Vulnerability

CVE-2026-55602 Overview

CVE-2026-55602 affects http-proxy-middleware, a widely used Node.js HTTP proxy middleware package. The vulnerability stems from improper input validation [CWE-20] in the router proxy-table host+path selector implementation. Versions from 0.16.0 up to 2.0.10, 3.0.6, and 4.1.0 use unanchored substring matching against attacker-controlled request metadata. A crafted Host header that is only a superstring match for a configured host+path key can route requests to an unintended backend. Maintainers fixed the issue in versions 2.0.10, 3.0.6, and 4.1.0.

Critical Impact
Attackers can manipulate Host headers to redirect proxy traffic to unintended backends, potentially bypassing access controls or reaching internal services.

Affected Products

http-proxy-middleware versions 0.16.0 through 2.0.9
http-proxy-middleware versions 3.0.0 through 3.0.5
http-proxy-middleware versions 4.0.0 through 4.0.x prior to 4.1.0

Discovery Timeline

2026-06-22 - CVE-2026-55602 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-55602

Vulnerability Analysis

The http-proxy-middleware package supports a router option that maps inbound requests to alternative backend targets. Documentation describes three selector types: host, path, or host+path combinations. The host+path selector should match the request's host and path against configured keys to determine routing.

The defect lies in how the host+path implementation performs key comparison. Instead of anchored or exact matching, the code uses unanchored substring matching on the request's Host header and URL path. An attacker controls the Host header and can supply a value that contains a configured key as a substring, satisfying the match condition for an entry that was not intended for the request.

The result is a routing bypass. Requests intended for one backend can be steered to a different backend defined in the proxy table. This affects integrity rather than confidentiality, since the proxy still forwards traffic but to the wrong destination.

Root Cause

The Host header is attacker-controlled metadata. Using substring containment as the match predicate on this value violates the principle of validating untrusted input against a strict grammar. The match logic should perform exact comparison of the parsed host component, not a String.prototype.includes style check.

Attack Vector

The vulnerability is exploitable remotely without authentication or user interaction. An attacker sends an HTTP request with a crafted Host header to any application that uses http-proxy-middleware with a host+path router configuration. No special tooling is required beyond a standard HTTP client. The vulnerability description and matching logic are documented in the GitHub Security Advisory GHSA-64mm-vxmg-q3vj.

Detection Methods for CVE-2026-55602

Indicators of Compromise

Inbound HTTP requests where the Host header contains an unexpected suffix or prefix appended to a known internal host string.
Proxy access logs showing requests routed to backends that do not correspond to the public-facing host of the original request.
Backend application logs receiving traffic with Host header values that do not match the backend's expected virtual host.

Detection Strategies

Audit application dependencies for http-proxy-middleware versions earlier than 2.0.10, 3.0.6, or 4.1.0 using npm ls http-proxy-middleware or software composition analysis tools.
Inspect application source code for router configurations that key on host+path combinations and review whether routing decisions trust the Host header.
Correlate reverse proxy logs with downstream service logs to detect mismatches between the requested host and the backend that served the response.

Monitoring Recommendations

Enable verbose logging on http-proxy-middleware to capture the resolved target for each request and alert on routing to internal-only backends from external sources.
Monitor for anomalous Host header values containing concatenated strings, embedded ports, or unusual character sequences.
Forward proxy and application logs to a centralized analytics platform and build detections for routing decisions inconsistent with the request's authenticated origin.

How to Mitigate CVE-2026-55602

Immediate Actions Required

Upgrade http-proxy-middleware to version 2.0.10, 3.0.6, or 4.1.0 depending on the major version branch in use.
Inventory all Node.js services that depend on the package, directly or transitively, and prioritize patching internet-facing applications.
Review existing router proxy-table configurations and remove host+path keys that could be matched as substrings of legitimate host values.

Patch Information

The maintainers released fixes in http-proxy-middleware 2.0.10, 3.0.6, and 4.1.0. The patch replaces unanchored substring matching with strict host comparison for host+path router keys. See the GitHub Security Advisory GHSA-64mm-vxmg-q3vj for the patch commits and version details.

Workarounds

Replace host+path router entries with pure path-based routing where backend selection does not depend on the Host header.
Validate the Host header at an upstream reverse proxy (such as NGINX or a WAF) and reject requests whose host does not exactly match an allowlisted value before traffic reaches the Node.js application.
Implement a custom router function that performs exact host matching rather than relying on the built-in host+path selector lookup.

bash

# Configuration example
npm install http-proxy-middleware@4.1.0
npm ls http-proxy-middleware