CVE-2026-55603 Overview
CVE-2026-55603 is an HTTP parameter injection vulnerability in http-proxy-middleware, a Node.js HTTP proxy middleware library maintained by chimurai. The flaw exists in the fixRequestBody() helper, which re-emits a request body previously consumed by a body parser. When the outgoing Content-Type is multipart/form-data, the handlerFormDataBodyData() function interpolates req.body keys and values into the multipart wire format without neutralizing carriage return and line feed (CR/LF) characters. Attackers can inject \r\n sequences to close the current part and add arbitrary new form parts, producing request smuggling across the trust boundary. The issue affects versions 3.0.4 through 3.0.6 and 4.1.0, and is fixed in 3.0.7 and 4.1.1.
Critical Impact
Attackers can desynchronize parsed request parameters between the proxy and the upstream backend, bypassing gateway-side policy and validation checks.
Affected Products
- chimurai http-proxy-middleware versions 3.0.4 through 3.0.6
- chimurai http-proxy-middleware version 4.1.0
- Node.js applications using fixRequestBody() with multipart/form-data proxying
Discovery Timeline
- 2026-06-22 - CVE-2026-55603 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-55603
Vulnerability Analysis
The vulnerability is classified under [CWE-93] Improper Neutralization of CRLF Sequences. The fixRequestBody() helper is the library's documented mechanism for replaying a request body that an upstream body parser already consumed. When proxying multipart/form-data requests, the helper invokes handlerFormDataBodyData() to reconstruct the multipart payload.
The reconstruction function concatenates req.body field names and values directly into the multipart wire format. Because CR/LF byte sequences are not stripped or encoded, an attacker who controls a field value can terminate the current MIME part and append additional parts. The proxy's body parser interprets the original input as a single opaque field, while the upstream backend parses the rebuilt body and observes the smuggled fields.
This parameter desynchronization defeats any gateway-side policy, authentication context, or input validation that operates on req.body before proxying. The EPSS score for this CVE is 0.243% as of 2026-06-25.
Root Cause
The root cause is missing input neutralization in the multipart body reconstruction path. The library trusts req.body field contents as safe to interpolate into a structured wire protocol that uses CR/LF as a delimiter.
Attack Vector
An attacker submits a request to the proxy containing a multipart field whose value includes a CR/LF sequence followed by a synthetic part boundary and additional form fields. The proxy's body parser stores the entire string as a single value. When fixRequestBody() rewrites the multipart body for the upstream request, the injected boundary takes effect, and the backend parses additional attacker-controlled fields. Refer to the GitHub Security Advisory GHSA-gcq2-9pq2-cxqm for further technical detail.
Detection Methods for CVE-2026-55603
Indicators of Compromise
- Multipart form field values containing raw \r\n byte sequences followed by strings matching the request's multipart boundary marker.
- Upstream backend logs showing request fields that were not present in the proxy's parsed request body.
- Discrepancies between WAF or API gateway audit logs and application-level field telemetry for the same request ID.
Detection Strategies
- Inspect proxied multipart requests for CR/LF characters inside field values before they reach fixRequestBody().
- Compare the number and identity of fields parsed at the proxy layer against those parsed by the backend application.
- Alert on multipart payloads where a field value contains the literal substring Content-Disposition: form-data.
Monitoring Recommendations
- Log raw request bodies at the upstream service for multipart traffic during patch rollout.
- Track the dependency inventory for http-proxy-middleware versions 3.0.4 through 3.0.6 and 4.1.0 across all Node.js services.
- Monitor for anomalous form fields appearing in authenticated endpoints that should not accept additional parameters.
How to Mitigate CVE-2026-55603
Immediate Actions Required
- Upgrade http-proxy-middleware to version 3.0.7 or 4.1.1 in all Node.js services.
- Audit application code for usage of fixRequestBody() with multipart/form-data routes and prioritize patching those paths.
- Revoke and rotate any credentials or tokens that may have been validated against desynchronized request fields.
Patch Information
The vulnerability is fixed in http-proxy-middleware version 3.0.7 and version 4.1.1. The patch neutralizes CR/LF characters when rebuilding multipart form bodies. See the chimurai security advisory GHSA-gcq2-9pq2-cxqm for release details.
Workarounds
- Reject incoming multipart requests at the proxy when any field value contains CR or LF bytes.
- Avoid calling fixRequestBody() for multipart/form-data routes and instead stream the original request body to the upstream without re-parsing.
- Move security-relevant validation to the upstream backend so that policy is enforced against the same parsed body the application uses.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
