[error] Error: [HPM] Missing "target" option. Example: {target: "http://www.example.org"}

[jpsla94]

Checks

• I understand project setup issues should be asked on StackOverflow or in GitHub Discussions.
• I updated to latest http-proxy-middleware.

Describe the bug (be clear and concise)

Hello,

I just upgraded from 3.0.5 to 3.0.7 to fix the latest vulnerabilities and now i getting the following exception bellow when i start front-end.

What can i do to fix this issue? Do i need to make changes to proxy config?

[error] Error: [HPM] Missing "target" option. Example: {target: "http://www.example.org"}     at verifyConfig (D:\example\example\ui-ag\node_modules\http-proxy-middleware\dist\configuration.js:7:15)     at new HttpProxyMiddleware (D:\example\example\ui-ag\node_modules\http-proxy-middleware\dist\http-proxy-middleware.js:138:42)     at createProxyMiddleware (D:\example\example\ui-ag\node_modules\http-proxy-middleware\dist\factory.js:6:28)     at getProxyMiddleware (D:\example\example\ui-ag\node_modules\webpack-dev-server\lib\Server.js:2303:18)     at Server.setupMiddlewares (D:\example\example\ui-ag\node_modules\webpack-dev-server\lib\Server.js:2353:12)     at Server.initialize (D:\example\example\ui-ag\node_modules\webpack-dev-server\lib\Server.js:1807:10)     at async Server.start (D:\example\example\ui-ag\node_modules\webpack-dev-server\lib\Server.js:3553:5)

Step-by-step reproduction instructions

1. ...
2. ...

Expected behavior (be clear and concise)

Project start successfully without exception trigger [error] Error: [HPM] Missing "target" option. Example: {target: "http://www.example.org"}

How is http-proxy-middleware used in your project?

`-- @angular-devkit/build-angular@20.3.29
  +-- http-proxy-middleware@3.0.5
  `-- webpack-dev-server@5.2.5 overridden
    `-- http-proxy-middleware@2.0.9

What http-proxy-middleware configuration are you using?

json file loaded through ng serve
{
 "/example/ui": {
   "target": "https://localhost:31079",
   "secure": false
 },
 "/example/api": {
   "target": "https://localhost:31079",
   "secure": false
 },
 "/example/rest": {
   "target": "https://localhost:31079",
   "secure": false
 }

What OS/version and node/version are you seeing the problem?

System:
    OS: Windows 10 10.0.20348
  Binaries:
    Node: 22.20.0
    npm: 11.6.2

Additional context (optional)

No response

[chimurai]

Think you are overriding http-proxy-middleware v2 with v3...

V3 is not backwards compatible with V2. (target is mapped differently in webpack-dev-server, leading to missing target)

If you are on v2 and if you indeed did override with v3, you can use v2.0.10, which has the backported security fixes (#1268)

v2.0.10 just got backported after the security advisory was published: https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.10

[jpsla94]

Thanks for the help @chimurai. I try 2.0.10 and report back.

[chimurai]

You might still get a security warning for 2.0.10 until github/advisory-database#8072 update is merged and published

[jpsla94]

I have changed to version suggest by @chimurai. I still have the security warning as mentioned, but it decreased the severity from high to moderate, which is acceptable to me for now.

[chimurai]

Thanks for reporting back. 🙏

The advisory is merged and updated an hour ago:
github/advisory-database#8072 (comment)

Might have a delay to propagate the updated advisory to the users.