CVE-2025-32996: Medium severity http-proxy-middleware http-proxy-middleware vulnerability
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/http-proxy-middlewareto a version that resolves this vulnerability.Fixed in 2.0.8 - Upgrade
Upgrade
npm/http-proxy-middlewareto a version that resolves this vulnerability.Fixed in 3.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32996?
CVE-2025-32996 has a medium severity rating due to potential improper handling of write operations.
How do I fix CVE-2025-32996?
To fix CVE-2025-32996, upgrade http-proxy-middleware to version 2.0.8 or later, or 3.0.4 or later.
What versions of http-proxy-middleware are affected by CVE-2025-32996?
CVE-2025-32996 affects versions of http-proxy-middleware before 2.0.8 and 3.x before 3.0.4.
What is the cause of the vulnerability in CVE-2025-32996?
The vulnerability in CVE-2025-32996 arises because writeBody can be called twice due to a lack of proper conditional checks.
Is CVE-2025-32996 part of any security compliance frameworks?
CVE-2025-32996 may impact compliance frameworks that require secure software practices, depending on the software development policies in place.