Http-proxy-middleware is a lightweight and versatile Node.js proxy middleware designed for Connect, Express, and BrowserSync. It simplifies the process of routing client requests through a proxy server, a common requirement in modern web development. Comparing versions 2.0.3 and 2.0.2, developers will find subtle but notable differences. The core dependencies remain consistent, ensuring similar functionality in both versions. Specifically, dependencies like is-glob, http-proxy, micromatch, is-plain-obj, and @types/http-proxy are unchanged, indicating a focus on stability and backward compatibility for key features.
The primary difference lies in the updated releaseDate, reflecting recent adjustments and potential bug fixes or minor enhancements in version 2.0.3. While the devDependencies and peerDependencies appear structurally identical, internal tweaks and optimizations might have been implemented. Developers should consider this when choosing a version, especially when prioritizing the most up-to-date fixes. The unpackedSize is slightly bigger in 2.0.3, which might mean additional features or more detailed logging utilities. To summarize, for new projects, opting for the latest 2.0.3 gives you an advantage, while developers with the running 2.0.2 are encouraged to evaluate the changelog and decide if the newer release provide important functionalities.
All the vulnerabilities related to the version 2.0.3 of the package
Denial of service in http-proxy-middleware
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
http-proxy-middleware can call writeBody twice because "else if" is not used
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
