Http-proxy-middleware version 1.3.1 is a minor update to the widely used Node.js proxy middleware, building upon the previous stable version 1.3.0. Both versions offer a streamlined, "one-liner" solution for proxying HTTP requests in Connect, Express, and BrowserSync applications. This makes it incredibly easy for developers to route client requests to backend servers, simplifying tasks like API integration, load balancing, and development server configuration.
The core dependencies, including is-glob, http-proxy, micromatch, is-plain-obj, and @types/http-proxy, remain consistent between the two versions, suggesting that the fundamental proxying logic hasn't undergone significant changes. The primary difference lies in the subtle adjustments and bug fixes implemented in version 1.3.1. Reviewing the change logs developers can observe changes in the unpacked size, with 1.3.1 showing a diff of 266 bytes, possibly indicating minor updates to code or documentation and most importantly the release date. Version 1.3.1 was released on April 28, 2021, just a few days after version 1.3.0 which was released on April 25, 2021.
For developers using or considering http-proxy-middleware, both versions provide a robust and convenient proxying solution. However, upgrading to 1.3.1 is generally recommended to benefit from the latest improvements and potential bug fixes, ensuring optimal stability and performance in your applications. The continued maintenance and minor releases demonstrate the package's active development and commitment to providing a reliable proxying solution for Node.js developers.
All the vulnerabilities related to the version 1.3.1 of the package
Denial of service in http-proxy-middleware
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
http-proxy-middleware can call writeBody twice because "else if" is not used
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
