Http-proxy-middleware version 2.0.2 introduces notable updates compared to version 2.0.1, primarily concerning its development dependencies and release metadata. For developers, the core functionality remains consistent, offering a reliable solution for proxying HTTP requests in Connect, Express, and BrowserSync environments.
The key differences lie in the updated versions of development tools. Version 2.0.2 upgrades several packages including, ws, jest, eslint, mockttp, ts-jest, prettier, @types/ws, supertest, typescript, @types/jest, @types/node, lint-staged, browser-sync, @types/express, @types/is-glob, @commitlint/cli, @types/supertest, @types/micromatch, @typescript-eslint/parser, @commitlint/config-conventional, and @typescript-eslint/eslint-plugin, reflecting a commitment to utilizing the latest tooling for testing, linting, and maintaining code quality. In contrast, version 2.0.1 relies on older versions of these dependencies, some of which had significant security patches or features.
The releaseDate also differs, indicating the newer release was published on January 23, 2022, while the older version was released on July 1, 2021. Developers integrating this middleware should consider these changes for compatibility within their existing development environments. While the core proxying capabilities are maintained, the updated development dependencies hint at improvements in the overall development workflow and potentially enhanced stability through rigorous testing and modern code analysis.
All the vulnerabilities related to the version 2.0.2 of the package
Denial of service in http-proxy-middleware
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
http-proxy-middleware can call writeBody twice because "else if" is not used
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
