By weakness (CWE)

CWE-187: related vulnerabilities

CVEs classified under CWE-187. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

2 published vulnerabilities

• CVE-2026-55602HIGH 8.6

  http-proxy-middleware, a widely-used Node.js library for routing HTTP requests to backend servers, contains a routing bypass flaw affecting versions 0.16.0 through 2.0.9, 3.0.5, and 4.0.x. When administrators configure the library to route requests based on a combination of hostname and path (host+path rules), the library incorrectly matches incoming requests using substring matching instead of exact matching. An attacker can craft a malicious Host header that contains the configured hostname as a substring—but with extra characters appended—and bypass the intended routing restrictions, directing requests to an unintended backend service. This could expose sensitive data, cause unauthorized access, or trigger unintended application behavior depending on what backends are exposed.

• CVE-2026-45692MEDIUM 5.4

  Caddy, a popular open-source web server known for automatic HTTPS, contains a path traversal vulnerability affecting versions 2.4.0 through 2.11.2. The vulnerability arises from a disagreement between two critical layers: the authorization system checks permissions using simple text matching, while the configuration API parses the same paths using numerical array indexing. An attacker with valid credentials can exploit this mismatch to access configuration objects they shouldn't be able to reach. For example, a user authorized to view `/config/servers/0` might be able to access `/config/servers/1` by manipulating how indices are parsed. The flaw requires authentication, so it primarily affects scenarios where multiple users or services share a Caddy instance.