npm / http-proxy-middleware

http-proxy-middleware

What changed in http-proxy-middleware 3 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

3 breaking3 security8 new APIs and options1 performance3 behavior and defaults9 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

http-proxy-middleware 425 changes

The package now ships as native ES modules only; CommonJS require() usage is no longer supported.
4.0.0release notes
The legacy compatibility wrapper was removed; use createProxyMiddleware() directly.
4.0.0release notes
The minimum supported runtime is now Node.js 22.15.0; support for Node.js 14, 16, 18, and 20 was dropped.
4.0.0release notes

Hardens form-data stringification in fixRequestBody.
3.0.7, 4.1.1release notes security advisory release notes
Hardened proxy-table matching to prevent routing bypass.
2.0.10, 3.0.6, 4.1.0release notes security advisory release notes release notes
Sanitized input in the error response plugin.
3.0.6, 4.0.0release notes release notes

Exports the OnProxyEvent type for use in TypeScript.
4.2.0release notes
Adds a diagnostic message for POST requests with bodyParser that encounter an ECONNRESET error.
4.2.0release notes
A helper function to create plugins is now available.
4.1.0release notes
Custom pathRewrite functions now receive res and options.
4.1.0release notes
The router function now receives res and options.
4.1.0release notes
zstd compression is supported in responseInterceptor and fixRequestBody.
4.1.0release notes
An experimental proxy middleware API was added for Hono apps.
4.0.0release notes
A dedicated subpath import was added for Hono support.
4.0.0release notes

The forward option now supports literal IPv6 URLs, such as http://[::1]:3000.
4.0.0release notes
The proxy implementation switched from http-proxy to httpxy, bringing upstream fixes, HTTP/2 support, and performance improvements.
4.0.0release notes
The target option now supports literal IPv6 URLs, such as http://[::1]:3000.
4.0.0release notes

The Filter callback return type was widened.
4.1.0release notes
Prevents trailer and content-length conflicts.
4.1.0release notes
Handles bodyless responses (HEAD/1xx/204/304) with content-encoding.
4.1.0release notes
WebSocket handling now supports multi-server upgrade subscriptions and safe proxy shutdown.
4.1.0release notes
Request body handling now supports text/plain content and content-encoding.
4.0.0release notes
The proxyRes callback type now allows a Promise<void> return type.
4.0.0release notes
Prevents a TypeError when WebSocket proxying is enabled but the server is undefined.
4.0.0release notes