CVE-2024-21536
CVE-2024-21536
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
CVSS 8.7 · High · EPSS 1.0% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
http-proxy-middleware
- Versions
- ≥ 0, < 2.0.7: Affected (semver)
- ≥ 3.0.0, < 3.0.3: Affected (semver)
Update to 2.0.7; Update to 3.0.3
org.webjars.npm:http-proxy-middleware
- Versions
- ≥ 0: Affected (semver)
No fix published
http-proxy-middleware npm
- Affected ranges
- SEMVER: < 2.0.7
Update to 2.0.7
http-proxy-middleware npm
- Affected ranges
- SEMVER: ≥ 3.0.0, < 3.0.3
Update to 3.0.3
Original sources
- https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8309098
- https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a
- https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22
- https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5
- https://nvd.nist.gov/vuln/detail/CVE-2024-21536