The http-proxy-agent package provides HTTP(s) proxy support for Node.js's built-in http and https modules, enabling developers to route HTTP requests through a proxy server. Comparing versions 1.0.0 and 2.0.0, several key changes emerge that impact developers. Version 2.0.0, released in June 2017, updates the core dependency agent-base from version 2 to version 4. This update likely incorporates improvements and bug fixes within the underlying agent framework. The extend dependency present in 1.0.0 is removed in 2.0.0, suggesting that its functionality may have been integrated directly or replaced with a different approach, simplifying the package's dependency tree. The debug dependency version is kept to version 2 in both versions.
Developers upgrading to version 2.0.0 should observe these dependency updates to ensure compatibility and potentially benefit from performance or functional enhancements in agent-base. The development dependencies are also slightly different, with mocha upgraded from version 2 to version 3, although this doesn't affect the final package consumed by users. Both versions maintain the same MIT license and are authored by Nathan Rajlich, ensuring consistent licensing and provenance. The core functionality of acting as an http.Agent remains consistent, making it a valuable tool for applications needing proxy support. The package's popularity likely stems from its ease of use and direct integration with Node.js's core HTTP modules, simplifying proxy configurations for various use cases like web scraping or circumventing network restrictions.
All the vulnerabilities related to the version 2.0.0 of the package
Resource Exhaustion Denial of Service in http-proxy-agent
A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
Denial of Service in http-proxy-agent
Versions of http-proxy-agent
before 2.1.0 are vulnerable to denial of service and uninitialized memory leak when unsanitized options are passed to Buffer
. An attacker may leverage these unsanitized options to consume system resources.
Update to version 2.1.0 or later.