CVE-2017-16014

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server, causing a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-703 CWE-388

Affected software

Vendor	Product	Versions
HackerOne	http-proxy node module	<=0.6.6

References

https://github.com/nodejitsu/node-http-proxy/pull/101Issue Tracking, Third Party Advisory
https://nodesecurity.io/advisories/323Third Party Advisory
https://github.com/nodejitsu/node-http-proxy/pull/101Issue Tracking, Third Party Advisory
https://nodesecurity.io/advisories/323Third Party Advisory

Timeline

Published: Jun 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-160156.1Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the applicati CVE-2017-160166.1Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (X CVE-2017-160176.1sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.CVE-2017-160186.1Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can CVE-2017-160196.1GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-CVE-2017-16024.3IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they shou CVE-2017-160209.8Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary CVE-2017-160216.5uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not CVE-2017-160226.1Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5 CVE-2017-160237.5Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular express CVE-2017-160246.5The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before CVE-2017-160255.9Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vu