http-proxy-middleware DoS Vulnerability via micromatch UnhandledPromiseRejection

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Denial of Service (DoS) 2. Affected Package: 3. Affected Version Range: and 4. Introduced Date: October 18, 2024 5. Severity: High (8.7) 6. Remediation Recommendation: Upgrade to version 2.0.7, 3.0.3, or higher. 7. Vulnerability Description: Affected versions suffer from a Denial of Service (DoS) attack due to an error in the library. Attackers can trigger this by sending requests to specific paths, causing the Node.js process to crash and the server to become unresponsive. 8. PoC (Proof of Concept): - Code example demonstrates how to run a server and send a request to trigger the vulnerability. - Expected result: Server crashes and displays an error. 9. Details: - Denial of Service (DoS) is an attack designed to make a system unavailable to legitimate users. - Unlike other vulnerabilities, DoS attacks typically do not aim to compromise security, but rather to render websites and services inaccessible. - A common variant is DDoS (Distributed Denial of Service), which overwhelms networks by generating massive traffic. - In open-source libraries, DoS vulnerabilities allow attackers to crash applications or services by exploiting code or library usage. 10. Types: - High CPU/Memory Consumption - Crash 11. References: - GitHub Commit - GitHub Commit - GitHub Gist 12. CVSS Score: - Version 4.0: 8.7 - Version 3.1: 8.7 13. Snyk Score: - Severity: High (8.7) - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - User Interaction: None - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High This information provides a detailed description of the vulnerability, its scope, remediation steps, and assessment results, helping users understand the severity and how to address it.

Goal Reached Thanks to every supporter — we hit 100%!

http-proxy-middleware DoS Vulnerability via micromatch UnhandledPromiseRejection