Description
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Remediation
References
https://hackerone.com/reports/319532
Related Vulnerabilities
CVE-2023-42794 Vulnerability in maven package org.apache.tomcat:tomcat
CVE-2023-40814 Vulnerability in maven package org.opencrx:opencrx-core-models
CVE-2020-7743 Vulnerability in maven package org.webjars:mathjs
CVE-2018-19057 Vulnerability in maven package org.webjars.npm:simplemde
CVE-2023-32315 Vulnerability in maven package org.igniterealtime.openfire:xmppserver