Executive brief
http-proxy-middleware is a Node.js library used to proxy HTTP requests in web applications. Versions before 2.0.7 and 3.0.0–3.0.2 contain a denial of service vulnerability that allows remote attackers to crash the server by sending requests to certain maliciously crafted paths, causing an unhandled promise rejection that terminates the Node.js process.
Technical details
The vulnerability is a Denial of Service (DoS) caused by an UnhandledPromiseRejection error thrown by the micromatch library during path filtering. When http-proxy-middleware processes requests to certain paths without proper error handling, the unhandled promise rejection crashes the Node.js process. The attack requires no authentication or user interaction and is reachable over the network. An attacker can exploit this by sending crafted HTTP requests to vulnerable paths, resulting in service unavailability. The issue was fixed in versions 2.0.7 and 3.0.3 by adding proper error handling for promise rejections in the filter logic.
Affected products
- chimurai http-proxy-middleware before 2.0.7 and 3.0.0 to 3.0.2
Timeline
- 2024-10-19: disclosed
- 2024-10-19: patched: Fixed in versions 2.0.7 and 3.0.3