CVE-2024-21536CWE-400denial-of-service

CVE-2024-21536

High · published October 19, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
63.5
In the wild
Unconfirmed
What it is

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01034 · 63.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-10-19T09:15Z
Affected products (2)
ProductVersionsFixed in
chimurai/http-proxy-middleware< 2.0.72.0.7
chimurai/http-proxy-middleware≥ 3.0.0, < 3.0.33.0.3
References (5)
https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a · [email protected]https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5 · [email protected]https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22 · [email protected]https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8309098 · [email protected]https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906 · [email protected]
EPSS history
Timeline
  • 19 OCT 05:00Z
    Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an…
    cvelistv5