Description
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Remediation
References
https://hackerone.com/reports/319532
Related Vulnerabilities
CVE-2021-21348 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2020-7690 Vulnerability in maven package org.webjars:jspdf
CVE-2021-33360 Vulnerability in npm package @stoqey/gnuplot
CVE-2023-39022 Vulnerability in maven package opensymphony:oscore
CVE-2022-36083 Vulnerability in npm package jose-node-cjs-runtime