Quick answers
- Is CVE-2024-21536 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-21536 being exploited in the wild.
- How severe is CVE-2024-21536?
- Low severity, with a CVSS score of 3.1, published 19 October 2024.
- Which products and versions are affected?
- http-proxy-middleware (npm) SEMVER:introduced=0,fixed=2.0.7.
- Is there a fix for CVE-2024-21536?
- Yes. http-proxy-middleware (npm): upgrade to 2.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-21536 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-21536?
- Check whether you run http-proxy-middleware (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- http-proxy-middleware (npm): upgrade to 2.0.7 or later
npm install http-proxy-middleware@2.0.7
Technical details
The vulnerability is a Denial of Service (DoS) caused by an UnhandledPromiseRejection error thrown by the micromatch library during path filtering. When http-proxy-middleware processes requests to certain paths without proper error handling, the unhandled promise rejection crashes the Node.js process. The attack requires no authentication or user interaction and is reachable over the network. An attacker can exploit this by sending crafted HTTP requests to vulnerable paths, resulting in service unavailability. The issue was fixed in versions 2.0.7 and 3.0.3 by adding proper error handling for promise rejections in the filter logic.
Affected products
- chimurai http-proxy-middleware before 2.0.7 and 3.0.0 to 3.0.2
Identifiers
- CVE-2024-21536
- GHSA-c7qv-q95q-8v27
Timeline
- 2024-10-19: disclosed
- 2024-10-19: patched: Fixed in versions 2.0.7 and 3.0.3