Denial of service in http-proxy-middleware

Description

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

Recommendation

Update the http-proxy-middleware package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.0.3

  < 2.0.7**

• Patched version(s): **3.0.3

  2.0.7**

References

• GHSA-c7qv-q95q-8v27
• security.snyk.io
• CVE-2024-21536
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• static-server Path Traversal vulnerability - CVE-2023-26152
• chromedriver Downloads Resources over HTTP - CVE-2016-10579
• http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed - CVE-2025-32997
• http-proxy-middleware can call writeBody twice because "else if" is not used - CVE-2025-32996

Tags:

npm

http-proxy-middleware