CVE-2024-21536: Http-proxy-middleware DoS Vulnerability

CVE-2024-21536 Overview

CVE-2024-21536 is a Denial of Service (DoS) vulnerability in the http-proxy-middleware npm package maintained by chimurai. The flaw affects versions before 2.0.7 and versions from 3.0.0 before 3.0.3. An attacker can trigger an UnhandledPromiseRejection error thrown by the micromatch dependency during path filtering. The unhandled rejection terminates the Node.js process, crashing servers that proxy requests through the middleware. The vulnerability is categorized under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Remote unauthenticated attackers can crash Node.js servers using http-proxy-middleware by sending crafted HTTP requests to paths that trigger the micromatch exception.

Affected Products

chimurai/http-proxy-middleware versions before 2.0.7
chimurai/http-proxy-middleware versions 3.0.0 through 3.0.2
Node.js applications and reverse proxies that rely on the middleware for path-based routing

Discovery Timeline

2024-10-19 - CVE-2024-21536 published to NVD
2024-11-01 - Last updated in NVD database

Technical Details for CVE-2024-21536

Vulnerability Analysis

The http-proxy-middleware package routes incoming HTTP requests based on context paths supplied by application configuration. During request handling, the middleware calls contextMatcher.match(), which delegates pattern evaluation to the micromatch library. When micromatch encounters malformed input from a request URL, it throws an exception inside a Promise chain. Because the original code did not wrap the matcher call in a try/catch block, the exception surfaced as an UnhandledPromiseRejection. Newer Node.js runtimes default to terminating the process on unhandled rejections, which causes the host server to crash.

Root Cause

The defect lives in src/http-proxy-middleware.ts inside the shouldProxy method. The method extracted req.originalUrl or req.url and passed it directly into contextMatcher.match without exception handling. Any throwable raised by micromatch during glob evaluation propagated upward and was not caught, leading to process exit.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request with a path crafted to cause micromatch to throw during pattern matching. The Node.js worker handling the request terminates, dropping all concurrent connections served by that process.

typescript

// Security patch from commit 0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5
// src/http-proxy-middleware.ts - fix(filter): handle errors
  * @return {Boolean}
  */
 private shouldProxy = (context, req: Request): boolean => {
-    const path = req.originalUrl || req.url;
-    return contextMatcher.match(context, path, req);
+    try {
+      const path = req.originalUrl || req.url;
+      return contextMatcher.match(context, path, req);
+    } catch (error) {
+      this.logger.error(error);
+      return false;
+    }
 };

Source: GitHub Commit Security Fix

The patch wraps the matcher in a try/catch, logs the error through the middleware logger, and returns false so the request bypasses the proxy without crashing the process. A companion fix in commit 788b21e4aff38332d6319557d4a5b1b13b1f9a22 extends the same defensive handling to pathFilter resolution.

Detection Methods for CVE-2024-21536

Indicators of Compromise

Repeated UnhandledPromiseRejection entries in Node.js stderr referencing micromatch or picomatch stack frames
Sudden process exits or container restarts on services that load http-proxy-middleware
HTTP 5xx spikes coinciding with anomalous request paths containing unusual glob metacharacters
Inventory results from npm ls http-proxy-middleware showing versions below 2.0.7 or in the 3.0.0–3.0.2 range

Detection Strategies

Run software composition analysis (SCA) against application manifests to flag vulnerable http-proxy-middleware ranges
Correlate process exit events with preceding HTTP request logs to identify the triggering URL pattern
Alert on unhandled rejection log lines emitted by Node.js when --unhandled-rejections=warn is configured

Monitoring Recommendations

Capture Node.js stdout and stderr in a centralized log platform and create rules for UnhandledPromiseRejection events
Track service availability metrics for proxy tiers and alert on repeated worker restarts within short intervals
Monitor reverse proxy access logs for request paths containing unescaped glob characters such as *, ?, [, and {

How to Mitigate CVE-2024-21536

Immediate Actions Required

Upgrade http-proxy-middleware to 2.0.7 for the 2.x branch or 3.0.3 for the 3.x branch
Audit dependency trees with npm audit or yarn npm audit to locate transitive installations of the vulnerable package
Restart affected Node.js services after upgrade to ensure the patched version is loaded

Patch Information

The upstream fix is delivered through two commits in the chimurai repository: GitHub Commit Security Fix handles errors in shouldProxy, and GitHub Commit Bug Patch hardens pathFilter resolution. Both fixes are included in the 2.0.7 and 3.0.3 releases. Additional analysis is available in the Snyk Vulnerability Report.

Workarounds

Place a web application firewall (WAF) in front of the proxy to reject requests containing glob metacharacters in the path
Override the Node.js flag with --unhandled-rejections=warn to keep the process alive while patching is in progress, accepting reduced visibility into real errors
Restrict the pathFilter and context configuration to literal prefixes instead of glob patterns where feasible

bash

# Configuration example: upgrade and verify the patched version
npm install http-proxy-middleware@^2.0.7
# or for the 3.x branch
npm install http-proxy-middleware@^3.0.3

# Confirm the installed version
npm ls http-proxy-middleware

# Optional runtime hardening while rolling out the patch
node --unhandled-rejections=warn server.js