By vendor

Chimurai vulnerabilities

Known CVEs affecting Chimurai products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-55602HIGH 8.6

  http-proxy-middleware, a widely-used Node.js library for routing HTTP requests to backend servers, contains a routing bypass flaw affecting versions 0.16.0 through 2.0.9, 3.0.5, and 4.0.x. When administrators configure the library to route requests based on a combination of hostname and path (host+path rules), the library incorrectly matches incoming requests using substring matching instead of exact matching. An attacker can craft a malicious Host header that contains the configured hostname as a substring—but with extra characters appended—and bypass the intended routing restrictions, directing requests to an unintended backend service. This could expose sensitive data, cause unauthorized access, or trigger unintended application behavior depending on what backends are exposed.

• CVE-2026-55603HIGH 7.5

  http-proxy-middleware is a popular Node.js library that relays HTTP requests through a proxy. The library includes a helper function called fixRequestBody() designed to re-send request bodies that were already read by middleware. When handling multipart form data (file uploads and form submissions), the library reconstructs the request body by inserting form field values directly into the wire format without escaping carriage return and line feed characters (\r\n). An attacker can exploit this by crafting a form submission where a field value contains these special characters, allowing them to inject additional form fields that the backend server will interpret as separate parameters. This creates a dangerous mismatch: the proxy's body parser validates the original fields, but the upstream server receives and processes injected fields, enabling request smuggling and parameter injection attacks.