Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-ftjz-3fh5-j7dz
|
Denial of Service in http-proxy
Versions of `http-proxy` prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an `ERR_HTTP_HEADERS_SENT` unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the `proxyReq.setHeader` function.
For a proxy server running on `http://localhost:3000`, the following curl request triggers the unhandled exception:
```curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')"```
## Recommendation
Upgrade to version 1.18.1 or later
|
GHSA-6x33-pw7p-hmpq
GMS-2020-737
|