CVE-2024-21536: chimurai http-proxy-middleware

csirt@kutim:~/threat-intel/cve/CVE-2024-21536

CVSS 7.5 · High EPSS 1,0%

Kerentanan Uncontrolled Resource Consumption pada chimurai http-proxy-middleware. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

Rincian

Terbit di NVD: 19 Oktober 2024
Terakhir diubah: 1 Agustus 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari): 1,0% peluang dieksploitasi; lebih tinggi dari 62,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
chimurai	http-proxy-middleware	Semua versi sebelum 2.0.7
chimurai	http-proxy-middleware	Versi 3.0.0 hingga sebelum 3.0.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5 patch
https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22 patch
https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a exploit · advisory pihak ketiga
https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906 advisory pihak ketiga
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8309098

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.