# http-proxy denial of service in request handling

Source: https://junglewise.ai/threats/http-proxy-denial-of-service-in-request-handling-8ddbad37  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2020-09-04

http-proxy is a Node.js library that routes HTTP requests between clients and backend servers. Versions before 1.18.1 crash when receiving HTTP POST requests with large bodies if the proxy server modifies request headers, causing temporary service outages. An attacker can trigger the crash remotely without authentication, disrupting the proxy's availability.

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 4 September 2020.

**Which products and versions are affected?** Http-Proxy SEMVER:introduced=0,fixed=1.18.1.

**Is there a fix for This vulnerability?** Yes. Http-Proxy: upgrade to 1.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run Http-Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Http-Proxy: upgrade to 1.18.1 or later

## Technical details

The vulnerability is an unhandled exception (ERR_HTTP_HEADERS_SENT) triggered when an HTTP request with a body larger than 1025 bytes is received and the proxy server calls proxyReq.setHeader() to modify request headers. The root cause is premature emission of the 'proxyReq' event before headers are finalized, allowing header modification after headers have already been sent to the destination. The attack is network-accessible and requires no authentication or user interaction; a simple POST request with a large payload triggers the crash. Affected versions prior to 1.18.1 are vulnerable; the fix was merged in May 2020 and checks for the 'expect' header before emitting the proxyReq event.

## Affected products

- http-party http-proxy prior to 1.18.1

## Timeline

- 2020-09-04: disclosed
- 2020-05-17: patched: Fix merged in PR #1447 (May 15, 2020), released as version 1.18.1

## References

- [https://github.com/http-party/node-http-proxy/pull/1447/commits/4718119ffbe895aecd9be0d6430357d44b4c7fd3](https://github.com/http-party/node-http-proxy/pull/1447/commits/4718119ffbe895aecd9be0d6430357d44b4c7fd3)
- [https://github.com/http-party/node-http-proxy/pull/1447/files](https://github.com/http-party/node-http-proxy/pull/1447/files)

## Related threats

- [http-proxy denial of service via insufficient error handling](https://junglewise.ai/threats/cve-2017-16014-http-proxy-denial-of-service-via-insufficient-error-handling)