What is the severity of CVE-2024-21536?

CVE-2024-21536 is categorized as a denial of service vulnerability due to unhandled promise rejections in http-proxy-middleware.

How do I fix CVE-2024-21536?

To fix CVE-2024-21536, update http-proxy-middleware to version 3.0.3 or later, or to 2.0.7 if using an earlier version.

Which versions of http-proxy-middleware are affected by CVE-2024-21536?

CVE-2024-21536 affects http-proxy-middleware versions from 3.0.0 to 3.0.2 and versions before 2.0.7.

What types of attacks can exploit CVE-2024-21536?

An attacker can exploit CVE-2024-21536 by sending specially crafted requests, which may crash the Node.js server.

Where can I find more information about CVE-2024-21536?

More information about CVE-2024-21536 can typically be found in security advisories and vulnerability databases.

Vulnerability/
CVE-2024-21536

high

7.5

CWE

400

19/10/2024

4/2/2025

CVE-2024-21536

First published: Sat Oct 19 2024(Updated: )

http-proxy-middleware is vulnerable to a denial of service, caused by an UnhandledPromiseRejection error thrown by micromatch. By sending specially crafted requests to certain paths, a remote attacker could exploit this vulnerability to kill the Node.js process and crash the server.

Credit: report@snyk.io report@snyk.io

Affected Software	Affected Version	How to fix
npm/http-proxy-middleware	>=3.0.0<3.0.3	3.0.3
npm/http-proxy-middleware	<2.0.7	2.0.7
http-proxy-middleware	<2.0.7
http-proxy-middleware	>=3.0.0<3.0.3

Remedy

https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5

Remedy

https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22

Never miss a vulnerability like this again

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

IBM-7182403

Frequently Asked Questions

What is the severity of CVE-2024-21536?
CVE-2024-21536 is categorized as a denial of service vulnerability due to unhandled promise rejections in http-proxy-middleware.
How do I fix CVE-2024-21536?
To fix CVE-2024-21536, update http-proxy-middleware to version 3.0.3 or later, or to 2.0.7 if using an earlier version.
Which versions of http-proxy-middleware are affected by CVE-2024-21536?
CVE-2024-21536 affects http-proxy-middleware versions from 3.0.0 to 3.0.2 and versions before 2.0.7.
What types of attacks can exploit CVE-2024-21536?
An attacker can exploit CVE-2024-21536 by sending specially crafted requests, which may crash the Node.js server.
Where can I find more information about CVE-2024-21536?
More information about CVE-2024-21536 can typically be found in security advisories and vulnerability databases.

agent/weakness
agent/type
agent/first-publish-date
collector/github-advisory-latest
source/GitHub
alias/GHSA-c7qv-q95q-8v27
alias/CVE-2024-21536
agent/software-canonical-lookup
collector/mitre-cve
source/MITRE
collector/nvd-cve
source/NVD
agent/author
collector/github-advisory
agent/remedy
agent/severity
agent/references
agent/event
agent/description
agent/trending
agent/source
collector/redhat-bugzilla
source/Red Hat
agent/last-modified-date
collector/nvd-api
agent/software-canonical-lookup-request
agent/softwarecombine
agent/tags
collector/ibm-support
source/IBM
package-manager/npm
vendor/chimurai
canonical/http-proxy-middleware
version/http-proxy-middleware/3.0.0

Frequently Asked Questions

What is the severity of CVE-2024-21536?
CVE-2024-21536 is categorized as a denial of service vulnerability due to unhandled promise rejections in http-proxy-middleware.
How do I fix CVE-2024-21536?
To fix CVE-2024-21536, update http-proxy-middleware to version 3.0.3 or later, or to 2.0.7 if using an earlier version.
Which versions of http-proxy-middleware are affected by CVE-2024-21536?
CVE-2024-21536 affects http-proxy-middleware versions from 3.0.0 to 3.0.2 and versions before 2.0.7.
What types of attacks can exploit CVE-2024-21536?
An attacker can exploit CVE-2024-21536 by sending specially crafted requests, which may crash the Node.js server.
Where can I find more information about CVE-2024-21536?
More information about CVE-2024-21536 can typically be found in security advisories and vulnerability databases.

CVE-2024-21536

Remedy

Remedy

Never miss a vulnerability like this again

Reference Links

Parent vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-21536?

How do I fix CVE-2024-21536?

Which versions of http-proxy-middleware are affected by CVE-2024-21536?

What types of attacks can exploit CVE-2024-21536?

Where can I find more information about CVE-2024-21536?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2024-21536?

How do I fix CVE-2024-21536?

Which versions of http-proxy-middleware are affected by CVE-2024-21536?

What types of attacks can exploit CVE-2024-21536?

Where can I find more information about CVE-2024-21536?