Denial of Service in http-proxy
Summary
GHSA-6x33-pw7p-hmpq: Denial of Service in http-proxy. Affects http-proxy versions < 1.18.1. Fixed in 1.18.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The http-proxy package is an npm package that provides a proxy server for HTTP requests. It allows users to create a proxy server that forwards requests to another server. This package is commonly used in web development to handle routing and load balancing. However, versions prior to 1.18.1 are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in http-proxy versions prior to 1.18.1 allows an attacker to trigger a DoS attack by sending an HTTP request with a long body. This request triggers an unhandled exception (ERR_HTTP_HEADERS_SENT) that crashes the proxy server. The vulnerability can only be exploited if the proxy server sets headers in the proxy request using the proxyReq.setHeader function. An attacker can exploit this vulnerability by sending a crafted request to the proxy server. The impact of this vulnerability is a complete denial of service, rendering the proxy server unavailable.
How To Fix
Minimum fixed version
1.18.1
This is the first release that contains the fix.
npm install http-proxy@1.18.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the only solution.
Conclusion
The http-proxy package prior to version 1.18.1 is vulnerable to a Denial of Service attack. To mitigate this vulnerability, it is crucial to upgrade to version 1.18.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for http-proxy →
FAQ
The http-proxy package is used to create a proxy server for handling HTTP requests. It is commonly used in web development for routing and load balancing.
A Denial of Service (DoS) attack is an attempt to make a computer or network resource unavailable to its intended users. In this case, the DoS attack is triggered by sending a crafted HTTP request with a long body, causing the proxy server to crash and become unavailable.
An attacker can exploit this vulnerability by sending a specially crafted HTTP request with a long body to the proxy server. This triggers an unhandled exception that crashes the server, resulting in a denial of service.
The impact of this vulnerability is a complete denial of service. The proxy server becomes unavailable, rendering it unable to handle any further requests.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the only solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for http-proxy.
