HeroDevs

Http Proxy Middleware Release Notes

Comprehensive release notes and changelog for Http Proxy Middleware, including security patches, bug fixes, and feature updates across all supported versions.

2 Patched Vulnerabilities
VEX Statements

0.19.x Releases

v0.19.4 - July 9, 2026

Notes

  • This release backports one security fix.
  • Full package name(s) and version(s):
    • @neverendingsupport/http-proxy-middleware@0.19.2-http-proxy-middleware-0.19.4

Dependency Updates

Security Fixes

  • router: host+path and path-only router keys are now matched against an exact host and a path prefix instead of an unanchored substring of the request Host header and path.
    • This fixes a medium-severity backend routing bypass vulnerability (CVE-2026-55602).

v0.19.3 - January 29, 2025

Notes

  • This release mainlines the OSS http-proxy-middleware v0.19.2 into NES v0.19.3.
  • Full package name(s) and version(s):
    • @neverendingsupport/http-proxy-middleware@0.19.2-http-proxy-middleware-0.19.3

Security Fixes

  • middleware: prevent an UnhandledPromiseRejection error from being thrown.
    • This fixes a high-severity Denial of Service (DoS) vulnerability (CVE-2024-21536).