{"id":"CVE-2024-21536","aliases":["CLSA-2026-1774657386","CLSA-2026-1776299658","CLSA-2026-1784164086","CLSA-2026-1784164093","CLSA-2026-1784596275","EUVD-2024-3014","GHSA-c7qv-q95q-8v27","ROOT-APP-NPM-CVE-2024-21536"],"status":"published","title":"Denial of service in http-proxy-middleware","description":"Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01034,"percentile":0.64276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-10-19T05:00:04Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"npm","package":"http-proxy-middleware","fixed_in":["2.0.7","3.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"http-proxy-middleware","fixed_in":["0.19.1-tuxcare.1","0.18.0-tuxcare.1","0.17.3-tuxcare.1","0.17.2-tuxcare.1","1.3.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"http-proxy-middleware","fixed_in":["0.19.1-aikido.2","1.3.1-aikido.1","0.19.1-aikido.3","2.0.3-aikido.1","2.0.7-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/http-proxy-middleware","fixed_in":["0.19.1-root.io.1","0.19.1-root.io.2","1.3.1-root.io.1","0.19.1-root.io.3","2.0.3-root.io.1","2.0.7-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"http-proxy-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"http-proxy-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"http-proxy-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.1-tuxcare.0"},{"fixed":"0.19.1-tuxcare.1"}]}],"versions":["0.19.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"http-proxy-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.0-tuxcare.0"},{"fixed":"0.18.0-tuxcare.1"}]}],"versions":["0.18.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"http-proxy-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.17.3-tuxcare.0"},{"fixed":"0.17.3-tuxcare.1"}]}],"versions":["0.17.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"http-proxy-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.17.2-tuxcare.0"},{"fixed":"0.17.2-tuxcare.1"}]}],"versions":["0.17.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"http-proxy-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.1-tuxcare.0"},{"fixed":"1.3.1-tuxcare.1"}]}],"versions":["1.3.1"]},{"source":"osv","ecosystem":"npm","package":"http-proxy-middleware","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.7"}]}]},{"source":"osv","ecosystem":"npm","package":"http-proxy-middleware","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"http-proxy-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.1-aikido.2"},{"fixed":"1.3.1-aikido.1"},{"fixed":"0.19.1-aikido.3"},{"fixed":"2.0.3-aikido.1"},{"fixed":"2.0.7-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/http-proxy-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.1-root.io.1"},{"fixed":"0.19.1-root.io.2"},{"fixed":"1.3.1-root.io.1"},{"fixed":"0.19.1-root.io.3"},{"fixed":"2.0.3-root.io.1"},{"fixed":"2.0.7-root.io.1"}]}]}],"products":[{"vendor":"chimurai","product":"http-proxy-middleware"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906","tags":["Third Party Advisory","web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8309098","tags":["web"]},{"url":"https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22","tags":["Patch","fix","web"]},{"url":"https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5","tags":["Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21536","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c7qv-q95q-8v27"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21536.json","tags":["advisory"]},{"url":"https://github.com/chimurai/http-proxy-middleware","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-21536","description":"Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.","status":"published","published":"2024-10-19T05:00:04.056Z","modified":"2026-08-02T15:25:24.64Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:04.681315Z"}],"euvd":[{"id":"EUVD-2024-3014","description":"Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.","status":"published","published":"2024-10-19T05:00:04Z","modified":"2026-08-02T15:25:24Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"updated_at":"2026-11-02T18:02:24.819631Z"}],"ghsa":[{"id":"GHSA-c7qv-q95q-8v27","title":"Denial of service in http-proxy-middleware","description":"Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.","status":"published","published":"2024-10-19T06:30:30Z","modified":"2024-10-22T19:47:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2024-21536","description":"Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.","status":"published","published":"2024-10-19T05:15:13.097Z","modified":"2026-08-01T16:16:29.963Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:10:32.45889Z"}],"osv":[{"id":"CVE-2024-21536","description":"Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.","status":"published","published":"2024-10-19T05:00:04.056Z","modified":"2026-10-28T02:31:13.651639149Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"GHSA-c7qv-q95q-8v27","title":"Denial of service in http-proxy-middleware","description":"Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.","status":"published","published":"2024-10-19T06:30:30Z","modified":"2026-09-10T03:50:19.674750568Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"CLSA-2026-1774657386","title":"TuxCare security update for http-proxy-middleware (1 CVE)","description":"TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.19.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.678623986Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776299658","title":"TuxCare security update for http-proxy-middleware (1 CVE)","description":"TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.18.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:47:49.841719961Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1784164086","title":"TuxCare security update for http-proxy-middleware (1 CVE)","description":"TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-15T09:47:35.021516569Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784164093","title":"TuxCare security update for http-proxy-middleware (1 CVE)","description":"TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-15T09:47:36.259297902Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784596275","title":"TuxCare security update for http-proxy-middleware (1 CVE)","description":"TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 1.3.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T19:13:10.924513731Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"ROOT-APP-NPM-CVE-2024-21536","title":"CVE-2024-21536 in http-proxy-middleware - Patched by Root","description":"Root has patched CVE-2024-21536 in the http-proxy-middleware package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-10T11:51:35Z","modified":"2026-09-10T12:15:14.561298369Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}