Http-proxy-middleware version 2.0.0 represents a notable update from the previous stable version 1.3.1, primarily impacting internal structure and potentially affecting some existing configurations. Both versions serve the same core purpose: providing a streamlined, one-liner solution for proxying HTTP requests within Node.js applications using Connect, Express, and BrowserSync. Key dependencies remain consistent between versions, including crucial packages like is-glob, http-proxy, and micromatch.
While the core functionality remains, developers upgrading to 2.0.0 should be aware of potential breaking changes in options handling and internal mechanisms. The expanded usage of Typescript-related dev dependencies in the new version may suggest under-the-hood modernization or improvements in type safety, potentially leading to more reliable and predictable behavior. Though both have the same dependencies, it's important to test your existing setup after the update. The changes made between both versions have made the unpacked size for 2.0.0 smaller. Ensure to check the official changelog and migration guide for precise upgrade instructions and to accommodate any necessary modifications to configurations or custom implementations when moving from version 1.3.1 to 2.0.0. The newer version was released on May 7th, 2021, a few days after the previous version of April 28th, 2021.
All the vulnerabilities related to the version 2.0.0 of the package
Denial of service in http-proxy-middleware
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
http-proxy-middleware can call writeBody twice because "else if" is not used
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.