Insufficient Error Handling in http-proxy

ALTO 7.5CVE-2017-16014 · GHSA-9xw9-pvgv-6p76 · Published 04/06/2018 · updated 17/06/2026

En resumen

CVE-2017-16014 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a http-proxy (http-proxy project), http-proxy.
Probabilidad de explotación en los próximos 30 días (EPSS): 1.7%, mayor que el 76.8% de las vulnerabilidades.
Solución: actualizar a 0.7.0 o posterior.

Package	Affected versions	Patched versions
http-proxy http-proxy_project	`< 0.7.0`	`0.7.0`
http-proxy npm	`< 0.7.0`	`0.7.0`

Description

Affected versions of http-proxy are vulnerable to a denial of service attack, wherein an attacker can force an error which will cause the server to crash.

Recommendation

Update to version 0.7.0 or later.

NVD description

Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server, causing a denial of service.

References

nvd.nist.gov/vuln/detail/CVE-2017-16014 · ADVISORY
nodejitsu/node-http-proxy#101 · WEB
GitHub Advisory GHSA-9xw9-pvgv-6p76 · ADVISORY
npmjs.com/advisories/323 · WEB
nodesecurity.io/advisories/323 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free