VDB
CVE-2024-21536
CVE-2024-21536
PUBLISHED
CVSS 8.7 HIGH
Denial of service in http-proxy-middleware
Reported by snyk · Published October 19, 2024
http-proxy-middleware is fixed in 3.0.3 and 2.0.7 (npm)
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| http-proxy-middleware | npm | 3.0.3, 2.0.7 |
| argo-workflows | Chainguard | 3.6.5-r2 |
| kubeflow-pipelines | Wolfi | 2.15.0-r1 |
| arangodb-3.11 | Chainguard | 3.11.14.5-r20 |
| kubeflow-katib | Wolfi | 0.19.0-r40, 0.19.0-r31 |
| kubeflow-katib | Chainguard | 0.19.0-r40, 0.19.0-r31 |
| kubeflow-pipelines | Chainguard | 2.15.0-r1 |
| argo-workflows | Wolfi | 3.6.5-r2 |
| http-proxy-middleware | chimurai | 3.0.3, 2.0.7 |
| http-proxy-middleware | n/a | 3.0.3, 2.0.7 |
Risk scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | http-proxy-middleware | 0, 3.0.0 |
| n/a | org.webjars.npm:http-proxy-middleware | 0 |
| chainguard | argo-workflows | 0 |
| npm | http-proxy-middleware | 3.0.0, 0 |
| wolfi | kubeflow-pipelines | 0 |
| chainguard | arangodb-3.11 | 0 |
| wolfi | kubeflow-katib | 0, 0 |
| n/a | org.webjars.npm:http-proxy-middleware | 0 |
| chainguard | kubeflow-katib | 0, 0 |
| n/a | http-proxy-middleware | 3.0.0, 0 |
| chimurai | http-proxy-middleware | 3.0.0, 0 |
| chainguard | kubeflow-pipelines | 0 |
| wolfi | argo-workflows | 0 |
Timeline
- Oct 19, 2024 CVE Published
- Oct 19, 2024 Coalition ESS Score (30 in total, the first dated here)
- Oct 20, 2024 EPSS Score (30 in total, the first dated here)
- Dec 19, 2024 GitHub Gist PoC
- Mar 17, 2025 CVE Updated
- Mar 10, 2026 Security Advisory (16 in total, the first dated here)
- Nov 2, 2026 Distribution Patch (15 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-21536
vulnetix vdb fixes CVE-2024-21536Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-21536/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart