CVE-2025-32996 @angular-devkit/build-angular uses a vulnerable version of http-proxy-middleware #30122
Description
Command
other
Is this a regression?
- Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was
No response
Description
From GHSA-4www-5p9h-95mh
@angular-devkit/build-angular@18.2.18 requires http-proxy-middleware@3.0.3
@angular-devkit/build-angular@18.2.18 requires http-proxy-middleware@^2.0.3 via webpack-dev-server@5.0.4
No patched version available for http-proxy-middleware
Transitive dependency http-proxy-middleware 3.0.3 is introduced via
@angular-devkit/build-angular 18.2.18 http-proxy-middleware 3.0.3
Minimal Reproduction
No need for steps to reproduce, the
Exception or Error
Your Environment
Angular CLI: 18.2.18
Node: 22.14.0
Package Manager: npm 10.9.2
OS: win32 x64
Angular: 18.2.13
... animations, cdk, common, compiler, compiler-cli, core, forms
... language-service, material, platform-browser
... platform-browser-dynamic, router
Package Version
---------------------------------------------------------
@angular-devkit/architect 0.1802.18
@angular-devkit/build-angular 18.2.18
@angular-devkit/core 18.2.18
@angular-devkit/schematics 18.2.18
@angular/cli 18.2.18
@schematics/angular 18.2.18
rxjs 7.8.1
typescript 5.5.4
zone.js 0.14.10
Anything else relevant?
No response