CVE-2017-16014: Insufficient Error Handling in http-proxy
Summary
CVE-2017-16014: Insufficient Error Handling in http-proxy. Affects http-proxy versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The http-proxy package is an npm package that provides a proxy server for HTTP requests. It allows users to create a proxy server that forwards requests to another server. The package is widely used in various applications to enable proxy functionality. However, versions of http-proxy prior to 0.7.0 are vulnerable to a denial of service attack. This vulnerability can be exploited by an attacker to force an error, causing the server to crash.
Vulnerability Detail
The vulnerability in http-proxy arises from insufficient error handling. An attacker can exploit this vulnerability by sending specially crafted requests that trigger an error condition in the server. This error condition is not properly handled, leading to a crash of the server. The impact of this vulnerability is a denial of service, as the server becomes unresponsive and stops serving legitimate requests. The vulnerability has been assigned a severity rating of MODERATE.
How To Fix
Latest published version: 1.18.1 as of 23 Oct 2026
npm install http-proxy@1.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.0
This is the first release that contains the fix.
npm install http-proxy@0.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The http-proxy package is vulnerable to a denial of service attack due to insufficient error handling. To mitigate this vulnerability, it is crucial to update to version 0.7.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for http-proxy →
FAQ
The impact of this vulnerability is a denial of service, as the server becomes unresponsive and stops serving legitimate requests.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
The recommended solution is to update to version 0.7.0 or later of the http-proxy package.
No, there is no known workaround for this vulnerability. Updating to the latest version is the recommended solution.
This vulnerability has been assigned a severity rating of MODERATE.
Related vulnerabilities
Recent vulnerabilities recorded for http-proxy.
