Skip to content

http-proxy-middleware outdated (CVE-2025-32996) #30140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
1 task
timKraeuter opened this issue Apr 22, 2025 · 2 comments
Closed
1 task

http-proxy-middleware outdated (CVE-2025-32996) #30140

timKraeuter opened this issue Apr 22, 2025 · 2 comments

Comments

@timKraeuter
Copy link

timKraeuter commented Apr 22, 2025

Command

other

Is this a regression?

  • Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used, see https://nvd.nist.gov/vuln/detail/CVE-2025-32996.

According to GitHub:

@angular-devkit/build-angular@19.2.8 requires http-proxy-middleware@3.0.3
@angular-devkit/build-angular@19.2.8 requires http-proxy-middleware@^2.0.7 via webpack-dev-server@5.2.0
No patched version available for http-proxy-middleware

The earliest fixed version is 3.0.5, which was published two weeks ago.

Minimal Reproduction

Use the latest Angular packages (build-angular 19.2.8 at the moment of writing) and check the package-lock.json.

Exception or Error


Your Environment

Angular CLI: 19.2.8
Node: 22.13.1
Package Manager: npm 10.9.0
OS: win32 x64

Angular: 19.2.7
... animations, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1902.8
@angular-devkit/build-angular   19.2.8
@angular-devkit/core            19.2.8
@angular-devkit/schematics      19.2.8
@angular/cdk                    19.2.10
@angular/cli                    19.2.8
@angular/material               19.2.10
@schematics/angular             19.2.8
rxjs                            7.8.1
typescript                      5.6.3
zone.js                         0.15.0

Anything else relevant?

No response

@timKraeuter
Copy link
Author

timKraeuter commented Apr 22, 2025

What about Angular 19 I see that the fix is only merged for Angular 18, @alan-agius4

@alan-agius4
Copy link
Collaborator

I have an open PR for that #30142

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants