chimurai http-proxy-middleware

• CVE-2026-55603 High 7.5 http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody` 0.3%
• CVE-2026-55602 Medium 6.9 http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass 0.4%
• CVE-2025-32996 Medium 4.0 In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. 0.5%
• CVE-2025-32997 Medium 4.0 In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. 0.5%