{"id":"GHSA-6x33-pw7p-hmpq","aliases":["ROOT-APP-NPM-GHSA-6x33-pw7p-hmpq"],"status":"published","title":"Denial of Service in http-proxy","description":"Versions of `http-proxy` prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an `ERR_HTTP_HEADERS_SENT` unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the `proxyReq.setHeader` function.   \n\nFor a proxy server running on `http://localhost:3000`, the following curl request triggers the unhandled exception:  \n```curl -XPOST http://localhost:3000 -d \"$(python -c 'print(\"x\"*1025)')\"```\n\n\n## Recommendation\n\nUpgrade to version 1.18.1 or later","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-184","CWE-693"],"published":"2020-09-04T17:59:49Z","modified":"2026-08-09T10:15:13Z","fixes":[{"ecosystem":"npm","package":"http-proxy","fixed_in":["1.18.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"http-proxy","fixed_in":["1.11.1-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/http-proxy","fixed_in":["1.11.1-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"http-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1"}]}]},{"source":"osv","ecosystem":"npm","package":"http-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"http-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/http-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-root.io.2"}]}]}],"references":[{"url":"https://github.com/http-party/node-http-proxy/pull/1447/files","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1486","tags":["web"]},{"url":"https://github.com/http-party/node-http-proxy/pull/1447/commits/4718119ffbe895aecd9be0d6430357d44b4c7fd3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6x33-pw7p-hmpq"}],"sources":{"ghsa":[{"id":"GHSA-6x33-pw7p-hmpq","title":"Denial of Service in http-proxy","description":"Versions of `http-proxy` prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an `ERR_HTTP_HEADERS_SENT` unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the `proxyReq.setHeader` function.   \n\nFor a proxy server running on `http://localhost:3000`, the following curl request triggers the unhandled exception:  \n```curl -XPOST http://localhost:3000 -d \"$(python -c 'print(\"x\"*1025)')\"```\n\n\n## Recommendation\n\nUpgrade to version 1.18.1 or later","status":"published","published":"2020-09-04T17:59:49Z","modified":"2024-01-29T20:57:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-184","CWE-693"],"updated_at":"2026-11-02T14:37:33.019154Z"}],"osv":[{"id":"GHSA-6x33-pw7p-hmpq","title":"Denial of Service in http-proxy","description":"Versions of `http-proxy` prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an `ERR_HTTP_HEADERS_SENT` unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the `proxyReq.setHeader` function.   \n\nFor a proxy server running on `http://localhost:3000`, the following curl request triggers the unhandled exception:  \n```curl -XPOST http://localhost:3000 -d \"$(python -c 'print(\"x\"*1025)')\"```\n\n\n## Recommendation\n\nUpgrade to version 1.18.1 or later","status":"published","published":"2020-09-04T17:59:49Z","modified":"2024-01-29T20:57:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-184","CWE-693"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"ROOT-APP-NPM-GHSA-6x33-pw7p-hmpq","title":"GHSA-6x33-pw7p-hmpq in http-proxy - Patched by Root","description":"Root has patched GHSA-6x33-pw7p-hmpq in the http-proxy package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T14:58:17Z","modified":"2026-08-09T10:15:13.025495024Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}