GitHub Advisoryadvisory · npm

GHSA-c7qv-q95q-8v27 Denial of service in http-proxy-middleware

HIGH Published 2024-10-19 Modified 2024-10-22 Official page ↗
Aliases
CVE-2024-21536
Ecosystem
npm
Packages
http-proxy-middleware
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2024-10-22

Affected packages

• npm http-proxy-middleware: < 2.0.7 → fixed in 2.0.7 • npm http-proxy-middleware: >= 3.0.0, < 3.0.3 → fixed in 3.0.3

Description

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

Related

Alias · CVE (1)

  • CVE-2024-21536 Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References