CVE-2024-21536

HIGH

Chimurai Http-proxy-middleware < 2.0.7 - Denial of Service

Title source: rule
STIX 2.1

Description

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

References (4)

Core 4

Scores

CVSS v3 7.5
EPSS 0.0035
EPSS Percentile 57.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-400
Status published
Products (2)
chimurai/http-proxy-middleware < 2.0.7
npm/http-proxy-middleware 0 - 2.0.7npm
Published Oct 19, 2024
Tracked Since Feb 18, 2026