Executive brief
http-proxy-agent is a Node.js library that enables applications to make HTTP requests through a proxy server. Versions before 2.1.0 fail to validate options passed to the Buffer constructor, allowing an attacker to trigger a denial of service by consuming excessive system resources or leaking uninitialized memory.
Technical details
The vulnerability stems from unsanitized options being passed directly to the Buffer constructor (CWE-400: Uncontrolled Resource Consumption). The vulnerable code at line 80 in index.js creates a Buffer with user-supplied options without validation, allowing an attacker to specify malicious size parameters. An attacker who can influence the options passed to http-proxy-agent (e.g., via a malicious proxy URL or configuration) can trigger excessive memory allocation or uninitialized memory leaks. The attack requires network access to the application or the ability to control proxy configuration. The fix is available in version 2.1.0 or later.
Affected products
- npm http-proxy-agent before 2.1.0
Timeline
- 2019-06-11: disclosed