Description
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Remediation
References
https://hackerone.com/reports/319532
Related Vulnerabilities
CVE-2021-34084 Vulnerability in npm package s3-uploader
CVE-2020-2295 Vulnerability in maven package org.jkva.maven-plugins:cascading-release-maven-plugin
CVE-2023-49398 Vulnerability in maven package com.jfinal:jfinal
CVE-2019-10769 Vulnerability in npm package safer-eval
CVE-2022-1274 Vulnerability in maven package org.keycloak:keycloak-services