# What changed in http-proxy-middleware

> 27 changes in http-proxy-middleware 3 to 4 from its official release notes, upgrade guides and advisories: 3 breaking, 3 security, 8 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/http-proxy-middleware/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## http-proxy-middleware 4

### Breaking changes

- The package now ships as native ES modules only; CommonJS require() usage is no longer supported. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)
- The legacy compatibility wrapper was removed; use createProxyMiddleware() directly. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)
- The minimum supported runtime is now Node.js 22.15.0; support for Node.js 14, 16, 18, and 20 was dropped. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)

### Security

- Hardens form-data stringification in fixRequestBody. (3.0.7, 4.1.1) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.1), [security advisory](https://github.com/advisories/GHSA-GCQ2-9PQ2-CXQM), [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.7)
- Hardened proxy-table matching to prevent routing bypass. (2.0.10, 3.0.6, 4.1.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.10), [security advisory](https://github.com/advisories/GHSA-64MM-VXMG-Q3VJ), [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.0), [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.6)
- Sanitized input in the error response plugin. (3.0.6, 4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.6), [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)

### New APIs and options

- Exports the OnProxyEvent type for use in TypeScript. (4.2.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.2.0)
- Adds a diagnostic message for POST requests with bodyParser that encounter an ECONNRESET error. (4.2.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.2.0)
- A helper function to create plugins is now available. (4.1.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.0)
- Custom pathRewrite functions now receive res and options. (4.1.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.0)
- The router function now receives res and options. (4.1.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.0)
- zstd compression is supported in responseInterceptor and fixRequestBody. (4.1.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.0)
- An experimental proxy middleware API was added for Hono apps. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)
- A dedicated subpath import was added for Hono support. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)

### Performance

- Response interception reduces buffer churn. (4.1.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.0)

### Behavior and default changes

- The forward option now supports literal IPv6 URLs, such as http://[::1]:3000. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)
- The proxy implementation switched from http-proxy to httpxy, bringing upstream fixes, HTTP/2 support, and performance improvements. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)
- The target option now supports literal IPv6 URLs, such as http://[::1]:3000. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)

### Fixes and other changes

- The Filter callback return type was widened. (4.1.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.0)
- Prevents trailer and content-length conflicts. (4.1.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.0)
- Handles bodyless responses (HEAD/1xx/204/304) with content-encoding. (4.1.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.0)
- WebSocket handling now supports multi-server upgrade subscriptions and safe proxy shutdown. (4.1.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.1.0)
- Request body handling now supports text/plain content and content-encoding. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)
- The proxyRes callback type now allows a Promise<void> return type. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)
- Prevents a TypeError when WebSocket proxying is enabled but the server is undefined. (4.0.0) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)

## http-proxy-middleware 3

### Fixes and other changes

- Added support for text/plain request bodies. (3.0.6) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.6)
- Fixed the Logger type. (3.0.6) — [release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.6)