contentful-import (5.0.2-beta1), http_bouncer_client (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2019-10196 via http-proxy-agent (2.0.0)

http-proxy-agent NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on http-proxy-agent and may be impacted: - contentful-import 5.0.2-beta1 - httpbouncerclient =1.0.1, =1.0.3 - request-light 0.2.2 Source cves: CVE-2019-10196 Source advisor...

CVE-2019-10196

The CVE-2019-10196 entry affects the http-proxy-agent package before version 2.1.0. The root cause is that the auth option is passed to the Buffer constructor without proper sanitization, enabling a Denial of Service that can consume all CPU resources, and potential data exposure due to an uninit...