Skip to content
OpenAdvisories
High · 7.5 CVE-2024-21536 EUVD-2024-3014GHSA-c7qv-q95q-8v27

Denial of service in http-proxy-middleware

Published Oct 19, 2024 · Updated Aug 2, 2026 · Assigned by snyk

Package: argo-workflows Package: http-proxy-middleware Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kubeflow-pipelines-frontend Ecosystem: npm Ecosystem: Wolfi

Description

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

Affected products

VendorProductAffectedFixed
— http-proxy-middleware < 2.0.7, 3.0.0 – < 3.0.3 2.0.7
— org.webjars.npm:http-proxy-middleware — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling argo-workflows 3.6.5-r2 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kubeflow-pipelines-frontend 2.15.0-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm http-proxy-middleware < 2.0.7 2.0.7 GHSA-c7qv-q95q-8v27
npm http-proxy-middleware >= 3.0.0, < 3.0.3 3.0.3 GHSA-c7qv-q95q-8v27

Advisories 3

References