CVE-2024-21536

HighCVSS 7.5

Published: 19/10/2024(UTC)Updated: 01/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.01%

60th percentile - higher than 60% of all known CVEs

Summary

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

Risk Assessment

The risk is server downtime due to a DoS attack, potentially leading to service unavailability.

Recommendation

Upgrade http-proxy-middleware to version 2.0.7 or later (for 2.x branch) or to version 3.0.3 or later (for 3.x branch).

Other vulnerabilities in http-proxy-middleware

CVE-2026-55603High
The http-proxy-middleware library in versions 3.0.4 to 3.0.7 and 4.1.1 has a vulnerability related to the fixRequestBody() method. When sending data in multipart/form-data format, an attacker can inject new form parts, leading to data desynchronization between the proxy and the backend.

Original NVD description (English source)