Executive brief
http-proxy is a popular Node.js library used to forward HTTP requests between servers. A denial-of-service vulnerability allows an attacker to crash the proxy server by triggering an unhandled error condition, causing service disruption and potential downtime for applications relying on the proxy.
Technical details
The vulnerability exists in http-proxy's error handling logic, classified as CWE-703 (Improper Check or Handling of Exceptional Conditions). When certain error conditions are triggered in middleware execution, the library fails to handle them gracefully and instead throws an uncaught exception, causing the server process to crash. An attacker can remotely craft requests that trigger these error conditions without authentication. The fix involves improving error propagation and providing event-based error handling to allow applications to respond to errors rather than crash. The vulnerability was patched in version 0.7.0 and later.
Affected products
- http-party http-proxy before 0.7.0
Timeline
- 2018-11-09: disclosed: Vulnerability published on GitHub Advisory Database
- 2011-09-01: patched: Fix merged in GitHub pull request #101; version 0.7.0 and later contain the fix
- 2017: other: CVE-2017-16014 assigned