Description
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Remediation
References
https://hackerone.com/reports/319532
Related Vulnerabilities
CVE-2018-5673 Vulnerability in maven package org.webjars.bowergithub.dojo:dojo
CVE-2019-17558 Vulnerability in maven package org.apache.solr:solr-velocity
CVE-2021-21277 Vulnerability in maven package org.webjars.npm:angular-expressions
CVE-2020-7740 Vulnerability in npm package node-pdf-generator
CVE-2018-16330 Vulnerability in maven package org.webjars.npm:editor.md