Http Proxy Middleware
Monthly
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, no authentication required.
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, no authentication required.
Denial of service in http-proxy-middleware allows unauthenticated remote attackers to crash the Node.js process by sending HTTP requests to specific paths that trigger an unhandled Promise rejection in the underlying micromatch path-matching library. Affected versions span the 2.x line (before 2.0.7) and the 3.x line (3.0.0 through before 3.0.3). A publicly available proof-of-concept exploit exists, and the CVSS 4.0 vector confirms full availability impact with no privileges or user interaction required, making this straightforward to weaponize against any exposed Node.js service using the middleware.
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, no authentication required.
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, no authentication required.
Denial of service in http-proxy-middleware allows unauthenticated remote attackers to crash the Node.js process by sending HTTP requests to specific paths that trigger an unhandled Promise rejection in the underlying micromatch path-matching library. Affected versions span the 2.x line (before 2.0.7) and the 3.x line (3.0.0 through before 3.0.3). A publicly available proof-of-concept exploit exists, and the CVSS 4.0 vector confirms full availability impact with no privileges or user interaction required, making this straightforward to weaponize against any exposed Node.js service using the middleware.