VULNERABILITY INTELLIGENCE

CVE-2024-21536

CVSS score7.5 HIGH
EPSS probability1.03%
CISA KEVNot currently listed
Published2024-10-19
Last modified2026-08-01
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

Weakness classification

  • report@snyk.io: CWE-400
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references