GHSA-6x33-pw7p-hmpq: 
JavaScript vulnerability analysis and mitigation

A high-severity Denial of Service vulnerability was discovered in http-proxy versions prior to 1.18.1. The vulnerability, identified as GHSA-6x33-pw7p-hmpq, was published to the GitHub Advisory Database on September 4, 2020. The vulnerability affects the npm package http-proxy and received a CVSS score of 7.5, indicating high severity (GitHub Advisory).

The vulnerability occurs when an HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This vulnerability is specifically triggered when the proxy server sets headers in the proxy request using the proxyReq.setHeader function. The issue can be reproduced by sending a POST request with a body length of 1025 characters or more to the proxy server (GitHub Advisory).

When successfully exploited, this vulnerability can cause a complete denial of service by crashing the proxy server. The CVSS metrics indicate high availability impact while maintaining unchanged scope, with no impact on confidentiality or integrity. The attack requires no special privileges or user interaction and can be executed remotely over the network (GitHub Advisory).

The vulnerability can be exploited by sending a specially crafted POST request to the affected proxy server. For example, on a proxy server running on http://localhost:3000, the following curl command can trigger the unhandled exception: curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')"(GitHub Advisory).

Users are recommended to upgrade to http-proxy version 1.18.1 or later, which contains the fix for this vulnerability. The fix involves skipping the proxyReq event when handling a request with the 'expect' header (GitHub Advisory, GitHub PR).