Is http-proxy 0.6 vulnerable?

npm · 6 releases from 0.6.0 to 0.6.6 · latest http-proxy is 1.18.1 · checked 1 Nov 2026

Yes: 2 known advisories

Yes. http-proxy 0.6.6, the last 0.6 release, is affected by 2 known security advisories (2 high), including CVE-2017-16014. Upgrade to 1.18.1 or later to fix all of them.

Upgrade with:npm install http-proxy@1.18.1

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting http-proxy 0.6.6

  • HighGHSA-6x33-pw7p-hmpq4 Sept 2020

    Denial of Service in http-proxy

    Affected
    <1.18.1
    Fixed in
    1.18.1
  • HighCVE-2017-16014GHSA-9xw9-pvgv-6p769 Nov 2018

    Insufficient Error Handling in http-proxy

    Affected
    <0.7.0
    Fixed in
    0.7.0

Which of your client projects are still on http-proxy 0.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact http-proxy version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other http-proxy versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.