GHSA-8w57-jfpm-945m Denial of Service in http-proxy-agent
An attacker can cause denial of service and memory leaks in http-proxy-agent by passing unsanitized options to Buffer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-8w57-jfpm-945m?
GHSA-8w57-jfpm-945m is a denial of service vulnerability in http-proxy-agent, published on 11 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of http-proxy-agent before 2.1.0 are vulnerable to denial of service and uninitialized memory leak when unsanitized options are passed to Buffer. An attacker may leverage these unsanitized options to consume system resources.
Recommendation
Update to version 2.1.0 or later.
Which versions are affected by GHSA-8w57-jfpm-945m?
2 open source packages ship an affected version, including http-proxy-agent.
| Package | Affected | Fixed in |
|---|---|---|
http-proxy-agent npm | All versions | 2.1.0 |
http-proxy-agent npm | All versions | 2.1.0 |
How do I fix GHSA-8w57-jfpm-945m?
Upgrade http-proxy-agent to 2.1.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-8w57-jfpm-945m being exploited?
There is no known exploitation of GHSA-8w57-jfpm-945m in the wild and no public exploit code.