CVE-2023-2968: Undefined variable usage in npm package "proxy" leads to remote denial of service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-05-30 · updated 2026-10-08
Weakness: CWE-232

Description

A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception.

Affected products

Proxy Project Proxy: from 2.0.0 before 2.1.1 — fixed in 2.1.1

How to fix

Upgrade to a fixed version: Proxy Project Proxy 2.1.1. Check the vendor advisory for mitigations.

References

https://research.jfrog.com/vulnerabilities/undefined-variable-usage-in-proxy-leads-to-remote-denial-of-service-xray-520917
https://research.jfrog.com/vulnerabilities/undefined-variable-usage-in-proxy-leads-to-remote-denial-of-service-xray-520917

Get alerted when CVE-2023-2968 or the next vulnerability affects your stack