Which versions of http-proxy-middleware are affected by CVE-2024-21536?

http-proxy-middleware, a critical Node.js routing library, contains an unauthenticated denial-of-service vulnerability that permits remote attackers to crash application processes.. A patch is available.

Is there a public PoC exploit available for CVE-2024-21536?

Yes, a public proof-of-concept exploit is available for CVE-2024-21536. Prioritise patching immediately. EPSS: 1.0%.

How to fix or mitigate CVE-2024-21536?

Within 24 hours, audit all Node.js infrastructure to identify services running http-proxy-middleware and determine current deployed versions. Within 7 days, upgrade affected services to http-proxy-middleware 2.0.7 or later (for 2.x users) and 3.0.3 or later (for 3.x users), prioritizing internet-facing services first and coordinating deployments to minimize downtime. Within 30 days, implement automated dependency scanning to prevent regression, configure monitoring for unexpected process crashes or restarts, and establish incident response procedures for similar availability vulnerabilities in middleware dependencies.

http-proxy-middleware CVE-2024-21536

Q: What is the CVSS score of CVE-2024-21536?

CVE-2024-21536 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

HIGH

Uncontrolled Resource Consumption (CWE-400)

2024-10-19 report@snyk.io

Denial Of Service Node.js Http Proxy Middleware Chimurai

7.7

CVSS 4.0 · Vendor: snyk

Severity by source

Vendor (snyk) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable, no auth, no interaction needed; only availability is impacted as the process crashes but no data is accessed or modified.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 01, 2026 - 16:28 vuln.today

Analysis Updated

Aug 01, 2026 - 16:28 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 01, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Aug 01, 2026 - 16:22 NVD

7.5 (HIGH) 7.7 (HIGH)

CVE Published

Oct 19, 2024 - 05:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

60 npm packages depend on http-proxy-middleware (13 direct, 47 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

AnalysisAI

Denial of service in http-proxy-middleware allows unauthenticated remote attackers to crash the Node.js process by sending HTTP requests to specific paths that trigger an unhandled Promise rejection in the underlying micromatch path-matching library. Affected versions span the 2.x line (before 2.0.7) and the 3.x line (3.0.0 through before 3.0.3). A publicly available proof-of-concept exploit exists, and the CVSS 4.0 vector confirms full availability impact with no privileges or user interaction required, making this straightforward to weaponize against any exposed Node.js service using the middleware.

Technical ContextAI

http-proxy-middleware (CPE: cpe:2.3:a:chimurai:http-proxy-middleware) is a widely-used Node.js middleware that proxies HTTP requests based on path filter rules, relying on the micromatch library for glob-pattern matching. The root cause (CWE-400: Uncontrolled Resource Consumption) is a missing error boundary around the context-matching call: when micromatch throws synchronously on certain path inputs, the error escapes as an unhandled Promise rejection. In Node.js, uncaught Promise rejections can terminate the entire process (behavior enforced by default since Node.js 15). The fix, visible in commit 0b4274e, wraps the contextMatcher.match() call in a try-catch, logging the error and returning false rather than allowing the exception to propagate. The vulnerable code path is in src/http-proxy-middleware.ts in the shouldProxy() method.

RemediationAI

Upgrade http-proxy-middleware to version 2.0.7 or later on the 2.x branch, or to 3.0.3 or later on the 3.x branch. The upstream fix is confirmed in commits 0b4274e and 788b21e4 on the chimurai/http-proxy-middleware GitHub repository. As a compensating control where immediate upgrade is not feasible, restrict access to the proxied service at the network or load-balancer layer so that arbitrary path inputs cannot reach the Node.js process. Additionally, configuring a process manager (such as PM2 or systemd) with automatic restart on crash reduces availability impact but does not eliminate the vulnerability. Note that auto-restart mitigates downtime but still permits repeated denial-of-service loops by a persistent attacker. No known configuration-level workaround removes the underlying flaw without patching.