HighGHSA-6x33-pw7p-hmpq

Denial of Service in http-proxy

Published 4 Sept 2020 · Updated 29 Jan 2024

Affected package

http-proxynpm
Affected
<1.18.1
Fixed in
1.18.1
Update to the fixed version for your release line, for example:npm install http-proxy@1.18.1

Details

Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

For a proxy server running on http://localhost:3000, the following curl request triggers the unhandled exception:

## Recommendation Upgrade to version 1.18.1 or later

Is GHSA-6x33-pw7p-hmpq in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected http-proxy, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.