← Back

CVE-2024-21536

nvd nist
Published: Oct 19, 2024Modified: Nov 1, 2024

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

Affected (2)

Chimurai
1 product
Http Proxy Middleware
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Chimurai
Http Proxy Middleware
Before 2.0.7
Http Proxy Middleware
From 3.0.0 to 3.0.3

Related CWEs

CWE-400
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (4)

Source: report@snyk.io
ExploitThird Party Advisory
Source: report@snyk.io
Patch
Source: report@snyk.io
Patch
Source: report@snyk.io
Third Party Advisory

Timeline

No history available yet.