CVE-2019-10196

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an...

CVE-2019-10196

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an...

Design/Logic Flaw

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an...

CVE-2019-10196

The CVE-2019-10196 entry affects the http-proxy-agent package before version 2.1.0. The root cause is that the auth option is passed to the Buffer constructor without proper sanitization, enabling a Denial of Service that can consume all CPU resources, and potential data exposure due to an uninit...

CVE-2019-10196

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an...

Nathan Rajlich node-http-proxy-agent 安全漏洞

Nathan Rajlich node-http-proxy-agent is an open source application by Nathan Rajlich. Provides an implementation of http.Agent to connect to a specified HTTP or HTTPS proxy server, and can be used with the built-in http module. A security vulnerability exists in http-proxy-agent prior to version...

USN-4808-1: Tinyproxy vulnerability

It was discovered that Tinyproxy created its pid file with insecure permissions. An attacker could use the vulnerability to cause arbitrary processes to be killed, resulting in a denial of service...

Prefix escape

Overview In fastify-http-proxy before version 4.3.1, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is...

@ddot/ddot-plugin-webpack (>=0.0.3 <=0.0.14), @harmonyjs/controller-auth-jwt (>=1.0.0 <=1.0.0-rc2.6) +8 more potentially affected by CVE-2021-21322 via fastify-http-proxy (>=0.7.0 <=4.1.0)

fastify-http-proxy NPM version =0.7.0, =0.0.3, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.0-alpha.2, =0.2.0, =1.1.0, =1.5.5 Source cves: CVE-2021-21322 Source advisory: OSV:GHSA-C4QR-GMR9-V23W...

Security Bulletin: IBM Security Verify Information Queue uses a Node.js proxy library that has a known vulnerability (183561)

Summary The web server in IBM Security Verify Information Queue ISIQ uses an older version of the http-proxy package that has a known vulnerability to a denial of service. As of v10.0.0, ISIQ has upgraded to a newer, secure version of http-proxy. Vulnerability Details Third Party Entry: 183561...

CVE-2021-21322

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

Design/Logic Flaw

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

CVE-2021-21322 Prefix escape

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessin...

CVE-2021-21322

CVE-2021-21322 affects the npm package fastify-http-proxy (a Fastify plugin for proxying HTTP requests). The vulnerability allows an attacker to escape the prefix of the proxied backend service by crafting a specific URL, potentially exposing or tampering with data exposed by the backend (confide...

PT-2021-14419

Name of the Vulnerable Software and Affected Versions fastify-http-proxy versions prior to 4.3.1 Description The issue allows an attacker to escape the prefix of the proxied backend service by crafting a specific URL. For example, if the base URL of the proxied server is /pub/, an attacker can...

Fedora 33 : libzypp / zypper (2021-ebc1c35c5d)

The remote Fedora 33 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-ebc1c35c5d advisory. - The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used...

CVE-2021-21299

hyper is an open-source HTTP library for Rust crates.io. In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple...

Design/Logic Flaw

hyper is an open-source HTTP library for Rust crates.io. In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple...

September 8, 2020—KB4577066 (Monthly Rollup)

None None...

Malicious Package

Overview All versions of http-proxy-middelware contain malicious code. The index.js file attempts to download a file from a remote server and execute it. The file is not run upon installation - the package needs to be required or the index.js run manually. The package contains a typo in its code...