http-proxy-middleware CVE-2024-21536

No special configuration is required beyond having http-proxy-middleware installed and active on a Node.js HTTP server that is reachable by the attacker. The middleware must be evaluating request paths against a filter pattern using micromatch - the default and most common usage. Exploitation is unauthenticated (CVSS PR:N) and requires no user interaction (UI:N). The limiting factor is that impact is confined to availability: the attacker can crash the Node.js process but cannot read data or modify state. If the server runs under a process manager with automatic restart, availability impact may be reduced to brief service interruptions per request rather than full persistent downtime. The vulnerability does not affect applications that bypass the path-filter logic (e.g., those passing a function filter that never invokes micromatch), but such configurations are uncommon.

The CVSS 4.0 base score of 7.7 with supplemental signal E:P (proof-of-concept exists) accurately reflects a high-availability, low-complexity threat. The attack vector is network (AV:N), complexity is low (AC:L), no privileges or interaction are required (PR:N/UI:N), and availability impact is high (VA:H) - this is a one-step crash vector. EPSS at 1.02% (59th percentile) is moderate, suggesting exploitation is theoretically straightforward but not yet observed at widespread scale. No KEV listing means active exploitation by threat actors has not been confirmed by CISA, though the public POC lowers the bar for any opportunistic attacker. The real-world severity is primarily determined by how exposed the Node.js application is: internet-facing services using this middleware as a reverse proxy or API gateway face meaningful risk; internal-only or containerized services with auto-restart policies face a lower effective impact. The availability-only impact (C:N/I:N) limits the blast radius to service disruption, not data compromise.

An attacker identifies a publicly accessible Node.js web application using http-proxy-middleware for request routing. Using the publicly available proof-of-concept (https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a), the attacker crafts an HTTP GET request targeting a path that causes micromatch to throw during filter evaluation. The unhandled Promise rejection terminates the Node.js process, taking the entire application offline until it is manually restarted or a process manager intervenes.