CVE-2026-55602

A flaw was found in http-proxy-middleware (before 2.0.10, 3.0.6, and 4.1.0). Router proxy-table host+path matching uses unanchored substring comparison on the Host header, so a crafted Host value that superstring-matches a configured key can route requests to an unintended backend.

http-proxy-middleware is vulnerable to unintended backend routing when host+path proxy-table entries are configured. Unanchored substring matching on the attacker-controlled Host header can match a configured host+path key without an exact host match, sending the request to the wrong backend. Red Hat exposure is in Node.js dev/proxy stacks that bundle the middleware for local or console plugin routing, including OpenShift console plugins, Cryostat, GitOps, and AAP Lightspeed where reverse proxy rules use host+path selectors.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.