Always-Incorrect Control Flow Implementation in http-proxy-middleware - CVE-2025-32996

Vulnerability identifier: #VU108925

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-32996

CWE-ID: CWE-670

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to writeBody can be called twice because "else if" is not used. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

http-proxy-middleware
Netcool Operations Insight
IBM Cloud Pak for Security
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Security Verify Governance
App Connect Enterprise Certified Container
IBM Cloud Pak for Business Automation
QRadar Suite
IBM Cloud Pak System
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Business Automation Insights
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Maximo Application Suite - IoT Component

Install updates from vendor's website.

http-proxy-middleware - addressed in versions 2.0.8, 3.0.4
Netcool Operations Insight - update to 1.6.15
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
IBM Cloud Pak System - update to 2.3.6.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.0.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.20, 8.11.18, 9.0.10
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.23, 9.0.15, 9.1.5
IBM Security Verify Governance - update to 10.0.2.0.7
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.2.1
Maximo Application Suite - IoT Component - addressed in versions 8.7.24, 8.8.20, 9.0.10, 9.1.1
App Connect Enterprise Certified Container - addressed in versions 12.0.11, 12.11.0
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF006, 24.0.1-IF004, 25.0.0-IF001

• https://github.com/chimurai/http-proxy-middleware/commit/020976044d113fc0bcbbaf995e91d05e2829a145
• https://github.com/chimurai/http-proxy-middleware/pull/1089
• https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.8
• https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.4

• Always-Incorrect Control Flow Implementation in http-proxy-middleware
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Edge Data Collector
• Multiple vulnerabilities in IBM Security Verify Governance