Executive brief
http-proxy-agent is a Node.js library used to tunnel HTTP requests through a proxy server. A flaw in versions before 2.1.0 allows an attacker to pass unsanitized input to the Buffer constructor via the auth parameter, causing denial of service through CPU exhaustion and potential memory leakage of uninitialized data.
Technical details
The vulnerability is an unsafe use of the deprecated Buffer constructor (CWE-665: Improper Initialization) in the auth parameter handling. When an attacker submits typed input to the auth parameter, it is passed unsanitized to the Buffer constructor without proper validation or use of Buffer.from(). This allows attackers to exhaust CPU resources via large buffer allocations and leak uninitialized memory contents. The fix, deployed in version 2.1.0, replaces the unsafe new Buffer() call with Buffer.from(). Attack vector is network-based with no authentication or user interaction required.
Affected products
- TooTallNate http-proxy-agent prior to 2.1.0
Timeline
- 2022-01-06: disclosed: GHSA advisory published