Advisories for Npm/Http-Proxy package

Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function. For a proxy server running on http://localhost:3000, the following curl request triggers the unhandled exception: curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')" Recommendation …

An attacker that forces an error can crash the server, causing a denial of service.

Because of the way errors are handled, an attacker that forces an error can crash the server, causing a denial of service.