Insufficient Error Handling in http-proxy

HOCH 7.5CVE-2017-16014 · GHSA-9xw9-pvgv-6p76 · Published 04/06/2018 · updated 17/06/2026

Kurz gesagt

CVE-2017-16014 ist eine Schwachstelle (HOCH (CVSS 7.5)) in http-proxy (http-proxy project), http-proxy.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.7%, höher als bei 76.8% aller Schwachstellen.
Abhilfe: auf 0.7.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
http-proxy http-proxy_project	`< 0.7.0`	`0.7.0`
http-proxy npm	`< 0.7.0`	`0.7.0`

Description

Affected versions of http-proxy are vulnerable to a denial of service attack, wherein an attacker can force an error which will cause the server to crash.

Recommendation

Update to version 0.7.0 or later.

NVD description

Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server, causing a denial of service.

References

nvd.nist.gov/vuln/detail/CVE-2017-16014 · ADVISORY
nodejitsu/node-http-proxy#101 · WEB
GitHub Advisory GHSA-9xw9-pvgv-6p76 · ADVISORY
npmjs.com/advisories/323 · WEB
nodesecurity.io/advisories/323 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free