CVE-2025-32996: chimurai http-proxy-middleware
CVSS: 5.3v3.1MediumAnalyzed
AliasesCGA-26xf-h79w-p2p6CGA-2mg2-rm68-xmjhCGA-36c8-978g-xvr5CGA-4r76-j5x8-v93qCGA-5c2f-586r-pq36CGA-5p2j-97fm-2p29CGA-643g-6427-x565CGA-73gh-c5gf-crhpCGA-7pj9-m2rw-mq4fCGA-8gm6-j84h-vxw9CGA-8m35-6mm2-qx24CGA-8pj7-xmj5-jmpwCGA-93w5-qxc6-j2mqCGA-9xvr-rj75-99m6CGA-fr53-695j-xqghCGA-g9p5-v74p-pmmvCGA-j94p-4xfh-q8jvCGA-ppx3-6vgw-x8j2CGA-q6wg-34f4-6f9wCGA-r8g6-2xcx-pf63CGA-rg57-4g22-j3rrCGA-vw93-h974-2pf7GHSA-4www-5p9h-95mhCGA-gmfg-5rrm-v9jfCGA-xrmp-786f-7x56
Published 15-04-2025Last modified 15-04-2025
Vulnerability summary
CVE-2025-32996 is a medium (CVSS 5.3) vulnerability in chimurai http-proxy-middleware. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.2% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
0.47%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 15-04-2025PublishedVulnerability first disclosed.
- 15-04-2025Last modifiedVulnerability information updated.
Description
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSources5 sources · 4.0–5.3
- CVE.orgCNA4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
- OSV · WolfiEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
- OSV · NpmEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
0.00 pp
From 0.46% on 21-09-2026
21-09-202621-10-2026
EPSS score0.47%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard12 products
- arangodb-3.11< 3.11.14.5-r20
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compat< 0.19.0-r40
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
Wolfi11 products
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compat< 0.19.0-r40
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
Chimurai1 product
- http-proxy-middleware< 2.0.8 | ≥ 3.0.0, < 3.0.4
Npm1 product
- http-proxy-middleware≥ 1.3.0, < 2.0.8 | ≥ 3.0.0, < 3.0.4
4 vendors · 25 products
