Uncontrolled resource consumption in http-proxy-middleware
Priority HIGH 77CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 20 fixed, 23 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01034 64th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial http-proxy-middleware: 2.0.7, 3.0.3http-proxy-middleware (npm): 2.0.7, 3.0.3Red Hat: 19 advisoriesRed Hat: 20 fixed, 23 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | http-proxy-middleware | before 2.0.7; 3.0.0 to before 3.0.3 | 2.0.7, 3.0.3 | Patch available | CNA |
| — | org.webjars.npm:http-proxy-middleware | all versions | — | No fix listed | CNA |
| — | http-proxy-middleware (npm) | before 2.0.7 | 2.0.7 | Patch available | GHSA-c7qv-q95q-8v27 |
| — | http-proxy-middleware (npm) | 3.0.0 to before 3.0.3 | 3.0.3 | Patch available | GHSA-c7qv-q95q-8v27 |
- http-proxy-middleware Vendor— Affected before 2.0.7; 3.0.0 to before 3.0.3 Fixed in 2.0.7, 3.0.3 Patch available CNA
- org.webjars.npm:http-proxy-middleware Vendor— Affected all versions Fixed in — No fix listed CNA
- http-proxy-middleware (npm) Vendor— Affected before 2.0.7 Fixed in 2.0.7 Patch available GHSA-c7qv-q95q-8v27
- http-proxy-middleware (npm) Vendor— Affected 3.0.0 to before 3.0.3 Fixed in 3.0.3 Patch available GHSA-c7qv-q95q-8v27
Remediation
- Fix · CNA http-proxy-middleware Fixed in 2.0.7, 3.0.3
- Fix · GHSA-c7qv-q95q-8v27 http-proxy-middleware (npm) Fixed in 2.0.7 Advisory →
- Fix · GHSA-c7qv-q95q-8v27 http-proxy-middleware (npm) Fixed in 3.0.3 Advisory →
Red Hat 19 advisories
- RHSA-2025:10853 Released 2025-07-14 · Red Hat rating ImportantRed Hat OpenShift Pipelines Release 1.19.0
- Red Hat OpenShift Pipelines 1.19 registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9, registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9
- RHSA-2025:9294 Released 2025-06-19 · Red Hat rating ImportantRed Hat OpenShift Pipelines Release 1.17.2
- Red Hat OpenShift Pipelines 1.17 registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel8
- RHSA-2025:8551 Released 2025-06-04 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.14.18 Bug Fix Update
- RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9 +1
Show 16 more Red Hat advisories
- RHSA-2025:8544 Released 2025-06-04 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.15.14 Bug Fix Update
- RHODF 4.15 for RHEL 9 odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +2
- RHSA-2025:8510 Released 2025-06-04 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.7 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-ui-rhel8
- RHSA-2025:8512 Released 2025-06-04 · Red Hat rating ImportantRed Hat OpenShift Pipelines Release 1.16.4
- Red Hat OpenShift Pipelines 1.16 registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel8
- RHSA-2025:8479 Released 2025-06-04 · Red Hat rating ImportantRHODF-4.16-RHEL-9 security update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +4
- RHSA-2025:8233 Released 2025-05-27 · Red Hat rating ImportantRed Hat OpenShift Pipelines Release 1.18.1
- Red Hat OpenShift Pipelines 1.18.0 registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9, registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9
- RHSA-2025:8059 Released 2025-05-21 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.7 Bug Fix Update
- RHODF 4.17 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +8
- RHSA-2025:4511 Released 2025-05-06 · Red Hat rating ImportantRHODF-4.18-RHEL-9 security update
- RHODF 4.18 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +7
- RHSA-2025:3930 Released 2025-04-15 · Red Hat rating ImportantRHACS 4.7 security update
- RHACS 4.7 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-main-rhel8 +9
- RHSA-2025:3929 Released 2025-04-15 · Red Hat rating ImportantACS 4.6 enhancement and security update
- RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
- RHSA-2025:3928 Released 2025-04-15 · Red Hat rating ImportantACS 4.5 enhancement and security update
- RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
- RHSA-2025:1249 Released 2025-02-10 · Red Hat rating Importantupdated discovery container images
- Discovery 1 for RHEL 9 discovery/discovery-server-rhel9, discovery/discovery-ui-rhel9
- RHSA-2024:11256 Released 2024-12-17 · Red Hat rating ImportantRed Hat Trusted Profile Analyzer 1.2.1
- Red Hat Trusted Profile Analyzer 1.2 registry.redhat.io/rhtpa/rhtpa-guac-rhel9
- RHSA-2024:11255 Released 2024-12-17 · Red Hat rating ImportantRed Hat Trusted Profile Analyzer 1.2.1
- Red Hat Trusted Profile Analyzer 1.2 registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9
- RHSA-2024:10962 Released 2024-12-11 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
- RHSA-2024:10917 Released 2024-12-10 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
- RHSA-2024:9627 Released 2024-11-14 · Red Hat rating ModerateRed Hat OpenShift Service Mesh Containers for 2.6.3
- RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +4
- RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 3 | Affected | No fix yet |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Migration Toolkit for Applications 7 | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2025:8510 |
| Discovery 1 for RHEL 9 | Fixed | RHSA-2025:1249 |
| RHACS 4.5 for RHEL 8 | Fixed | RHSA-2025:3928 |
| RHACS 4.6 for RHEL 8 | Fixed | RHSA-2025:3929 |
| RHACS 4.7 for RHEL 8 | Fixed | RHSA-2025:3930 |
| RHODF 4.14 for RHEL 9 | Fixed | RHSA-2025:8551 |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2025:8544 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2025:8479 |
| RHODF 4.17 for RHEL 9 | Fixed | RHSA-2025:8059 |
| RHODF 4.18 for RHEL 9 | Fixed | RHSA-2025:4511 |
| RHOSSM 2.6 for RHEL 8 | Fixed | RHSA-2024:9627 |
| RHOSSM 2.6 for RHEL 9 | Fixed | RHSA-2024:9627 |
| Red Hat Developer Hub (RHDH) 1.4 | Fixed | — |
| Red Hat Developer Hub 1.3 for RHEL 9 | Fixed | — |
| Red Hat OpenShift Pipelines 1.16 | Fixed | RHSA-2025:8512 |
| Red Hat OpenShift Pipelines 1.17 | Fixed | RHSA-2025:9294 |
| Red Hat OpenShift Pipelines 1.18.0 | Fixed | RHSA-2025:8233 |
| Red Hat OpenShift Pipelines 1.19 | Fixed | RHSA-2025:10853 |
| Red Hat OpenShift distributed tracing 3.4 | Fixed | RHSA-2024:10917, RHSA-2024:10962 |
| Red Hat Trusted Profile Analyzer 1.2 | Fixed | RHSA-2024:11255, RHSA-2024:11256 |
Not affected: 26 products
- 8Base-RHMTC-1.8
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- OpenShift Lightspeed
- OpenShift Serverless
- RHODF 4.14 for RHEL 9
- RHODF 4.15 for RHEL 9
- RHODF 4.16 for RHEL 9
- RHODF 4.17 for RHEL 9
- RHODF 4.18 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2
- Red Hat Developer Hub (RHDH) 1.4
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.3 for RHEL 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Pipelines 1.16
- Red Hat OpenShift Pipelines 1.17
- Red Hat OpenShift Pipelines 1.18.0
- Red Hat OpenShift Pipelines 1.19
- Red Hat OpenShift distributed tracing 3.4
- Red Hat Process Automation 7
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-21536
- 2026-10-03 Alias added: GHSA-c7qv-q95q-8v27
- 2026-10-27 Affected versions changed · Red Hat
References
Patch 2
More chimurai Http-proxy-middleware vulnerabilities
- TI-2026-40136 http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass CVSS 4.0MEDIUM 6.9
- TI-2026-40137 http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody` CVSS 3.1HIGH 7.5
- TI-2025-24005 In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. CVSS 3.1MEDIUM 5.3
- TI-2025-24004 In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-21536 · CVE Program
- CVE-2024-21536 · NVD
- FIRST EPSS
- GHSA-c7qv-q95q-8v27 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-21536 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences