We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Hello, I have tried everything to contact the maintainers, nobody answer to me, there is my last try.
There is populate headers into outgoing request from incoming: https://github.com/http-party/node-http-proxy/blob/master/lib/http-proxy/common.js#L43
if then add Trailer header with any value into the incoming request, that header will be handled by the internal nodejs http lib. For a GET-request, processing that header will trigger unhandled error ERR_HTTP_TRAILER_INVALID. https://github.com/nodejs/node/blob/38cc53845307fdb81dd50cfb7bcfc8c7b83b947c/lib/_http_outgoing.js#L538
Trailer
ERR_HTTP_TRAILER_INVALID
An unhandled error will cause nodejs shutdown.
If any other project uses node-http-proxy package and just proxy any "user" request, all of them are vulneranilty to DoS attack
node-http-proxy
The text was updated successfully, but these errors were encountered:
I think the right thing to do would be to report the vulnerability to Snyk (link), which will assign it a CVE.
Sorry, something went wrong.
No branches or pull requests
Hello, I have tried everything to contact the maintainers, nobody answer to me, there is my last try.
There is populate headers into outgoing request from incoming:
https://github.com/http-party/node-http-proxy/blob/master/lib/http-proxy/common.js#L43
if then add
Trailer
header with any value into the incoming request, that header will be handled by the internal nodejs http lib. For a GET-request, processing that header will trigger unhandled errorERR_HTTP_TRAILER_INVALID
. https://github.com/nodejs/node/blob/38cc53845307fdb81dd50cfb7bcfc8c7b83b947c/lib/_http_outgoing.js#L538An unhandled error will cause nodejs shutdown.
If any other project uses
node-http-proxy
package and just proxy any "user" request, all of them are vulneranilty to DoS attackThe text was updated successfully, but these errors were encountered: