CVE-2026-55603

A flaw was found in http-proxy-middleware. A remote attacker could exploit a vulnerability in the fixRequestBody() function, which is used to re-emit a request body. By injecting carriage return and line feed characters (\r\n) into a request body key or value, an attacker can bypass security policies and validation performed by the proxy. This desynchronization between the proxy and the backend server can lead to a compromise of data integrity.

Red Hat rates this issue as having Moderate impact for Red Hat products that bundle http-proxy-middleware 3.0.5 in a proxy configuration that re-emits an already-consumed request body via fixRequestBody(). Affected components are tracked via delegated engineering trackers and include Cluster Observability Operator's Prometheus console proxy, the Konflux mintmaker-renovate-image, Migration Toolkit for Applications (MTA) UI, RHTAS console UI, and RHTPA/Trustification service. Red Hat OpenShift AI MLflow images were initially assessed as in-scope but ship http-proxy-middleware 1.3.1/2.0.6, both outside the vulnerable ranges (>= 3.0.4, < 3.0.7 and >= 4.0.0, < 4.1.1), and are not affected. Other Red Hat products either do not bundle an affected http-proxy-middleware version or do not expose the vulnerable code path in normal operation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network access to affected proxy services. Do not pass untrusted user input into proxy target or header configuration. Upgrade http-proxy-middleware to 3.0.7 or 4.1.1 (or later) once updated packages are available for the affected components.