CVE-2024-21536: Denial of service in http-proxy-middleware
7.5
Basic Information
JavaScriptTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| http-proxy-middleware | npm | < 2.0.7 | 2.0.7 |
| http-proxy-middleware | npm | >= 3.0.0, < 3.0.3 | 3.0.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability description states that a Denial of Service occurs due to an UnhandledPromiseRejection error thrown by micromatch when processing certain paths. The provided commit patches (0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5 and 788b21e4aff38332d6319557d4a5b1b13b1f9a22) both modify the shouldProxy method within the HttpProxyMiddleware class in src/http-proxy-middleware.ts.
In both commits, the change involves wrapping the call to path matching functions (contextMatcher.match in the older version, and matchPathFilter in the newer version) within a try-catch block. This directly addresses the issue of unhandled errors originating from the path matching logic (which relies on micromatch).
Therefore, the HttpProxyMiddleware.shouldProxy method, in its state before these patches, is the vulnerable function. It processes request paths (via the matcher functions) and lacked the necessary error handling, making it the point in the http-proxy-middleware codebase where the micromatch error would lead to a DoS. This function would appear in a runtime profile or stack trace when the vulnerability is triggered by a malicious request path that causes micromatch to throw an unhandled error.