Is http-proxy-middleware 0.6 vulnerable?

npm · 1 release from 0.6.0 to 0.6.0 · latest http-proxy-middleware is 4.2.1 · checked 2 Nov 2026

Yes: 1 known advisory

Yes. http-proxy-middleware 0.6.0, the last 0.6 release, is affected by 1 known security advisory (1 high), including CVE-2024-21536. Upgrade to 2.0.7 or later to fix all of them.

Upgrade with:npm install http-proxy-middleware@2.0.7

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting http-proxy-middleware 0.6.0

  • HighCVE-2024-21536GHSA-c7qv-q95q-8v2719 Oct 2024

    Denial of service in http-proxy-middleware

    Affected
    <2.0.7 · >=3.0.0 <3.0.3
    Fixed in
    2.0.7, 3.0.3

Which of your client projects are still on http-proxy-middleware 0.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact http-proxy-middleware version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other http-proxy-middleware versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.