Denial of Service (DoS)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Denial of Service DoS via the HTTP metrics middleware in rust/src/server/src/middleware/metrics.rs, where arbitrary HTTP method tokens sent by an...

PT-2026-122457

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track http metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method token...

PT-2026-106271

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description The Rust frontend's track http metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary...

Malicious code in http-metrics-middleware (npm)

npm/http-metrics-middleware is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malware in http-metrics-middleware

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...