CVE-2024-21536

A flaw was found in the http-proxy-middleware package. Affected versions of this package are vulnerable to denial of service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. This flaw allows an attacker to kill the Node.js process and crash the server by requesting certain paths.

This vulnerability is rated with a Moderate impact for Red Hat products because an unauthenticated remote request can terminate the backend Node.js process, yet it does not compromise data confidentiality or system integrity. In typical Red Hat environments such as OpenShift container platforms and web consoles, orchestrators automatically restart crashed application pods, which limits the blast radius to transient service disruption. Furthermore, the flaw only causes service termination without enabling arbitrary code execution or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat Product Security does not have any mitigation recommendations at this time.