Http-proxy, a versatile reverse proxy for Node.js, saw a notable update moving from version 0.9.1 to 0.10.0 in March 2013. While the core dependencies like 'utile', 'colors', 'pkginfo', and 'optimist' remained consistent, developers should note the release date difference. Version 0.10.0 was released on March 18, 2013, a little over a week after version 0.9.1 which came out on March 9, 2013. This quick iteration suggests possible bug fixes, performance improvements, or minor feature additions. Both versions maintain the same suite of development dependencies, including 'ws' for WebSocket support, 'vows' for asynchronous testing, 'async' for control flow, 'request' for making HTTP requests, and 'socket.io' and 'socket.io-client' for real-time communication.
For developers considering integrating http-proxy, this consistency in dependencies implies a stable API and similar feature set between the two minor versions, easing the transition. The package's robust feature set makes it a suitable choice for routing requests, load balancing, and managing WebSocket connections in Node.js applications. The availability of socket.io as a dev dependency also highlights that the library can be used to proxy websocket connections. Both packages are authored by Nodejitsu Inc. and available on Github. Choosing the newest version, 0.10.0, over its older version, is recommended as it likely incorporates refinements and solves any previously existing issues.
All the vulnerabilities related to the version 0.10.0 of the package
Denial of Service in http-proxy
Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.
For a proxy server running on http://localhost:3000, the following curl request triggers the unhandled exception:
curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')"
Upgrade to version 1.18.1 or later
