Insufficient Error Handling in http-proxy

ÉLEVÉE 7.5CVE-2017-16014 · GHSA-9xw9-pvgv-6p76 · Published 04/06/2018 · updated 17/06/2026

En bref

CVE-2017-16014 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant http-proxy (http-proxy project), http-proxy.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.7%, plus élevée que 76.8% des vulnérabilités.
Correctif : mettre à jour vers 0.7.0 ou plus récent.

Package	Affected versions	Patched versions
http-proxy http-proxy_project	`< 0.7.0`	`0.7.0`
http-proxy npm	`< 0.7.0`	`0.7.0`

Description

Affected versions of http-proxy are vulnerable to a denial of service attack, wherein an attacker can force an error which will cause the server to crash.

Recommendation

Update to version 0.7.0 or later.

NVD description

Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server, causing a denial of service.

References

nvd.nist.gov/vuln/detail/CVE-2017-16014 · ADVISORY
nodejitsu/node-http-proxy#101 · WEB
GitHub Advisory GHSA-9xw9-pvgv-6p76 · ADVISORY
npmjs.com/advisories/323 · WEB
nodesecurity.io/advisories/323 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free