CVE-2019-10196

Improper Initialization in npm/http-proxy-agent

Identifiers

GHSA-86wf-436m-h424, CVE-2019-10196

Package Slug

npm/http-proxy-agent

Vulnerability

Improper Initialization

Description

A flaw was found in http-proxy-agent, It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.

Affected Versions

All versions before 2.1.0

Solution

Upgrade to version 2.1.0 or above.

Last Modified

2022-01-11

source