GitHub Advisoryadvisory · npm

GHSA-86wf-436m-h424 Resource Exhaustion Denial of Service in http-proxy-agent

MEDIUM Published 2022-01-06 Modified 2021-03-31 Official page ↗
Aliases
CVE-2019-10196
Ecosystem
npm
Packages
http-proxy-agent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-665
Reviewed
2021-03-22

Affected packages

• npm http-proxy-agent: < 2.1.0 → fixed in 2.1.0

Description

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.

Related

Alias · CVE (1)

  • CVE-2019-10196 A flaw was found in http-proxy-agent, prior to version 2.1.0. vulnerability

Weakness · CWE (1)

  • CWE-665 Improper Initialization weakness

References