CVE-2019-10196: Resource Exhaustion Denial of Service in http-proxy-agent
Summary
CVE-2019-10196: Resource Exhaustion Denial of Service in http-proxy-agent. Affects http-proxy-agent versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The http-proxy-agent package is an npm package that provides an HTTP proxy agent implementation for Node.js. It allows users to make HTTP requests through a proxy server. The package is widely used in various Node.js applications and frameworks.
Vulnerability Detail
A flaw was discovered in http-proxy-agent versions prior to 2.1.0. The package passes an auth option to the Buffer constructor without proper sanitization. This vulnerability can be exploited by an attacker who can submit typed input to the auth parameter. By exploiting this vulnerability, an attacker can cause a Denial of Service (DoS) by consuming all available CPU resources. Additionally, there is a potential data exposure risk through an uninitialized memory leak.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
npm install http-proxy-agent@2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the http-proxy-agent package.
Conclusion
The http-proxy-agent package prior to version 2.1.0 is vulnerable to a resource exhaustion DoS and potential data exposure. It is crucial to upgrade to the fixed version to mitigate these risks. For further assistance, please reach out to DevNack.com.
See every vulnerability recorded for http-proxy-agent →
FAQ
This vulnerability can lead to a Denial of Service (DoS) condition by consuming all available CPU resources. It may also result in data exposure through an uninitialized memory leak.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
Yes, upgrading to version 2.1.0 or later of the http-proxy-agent package fixes this vulnerability.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
For further support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for http-proxy-agent.
