The https-proxy-agent npm package provides an essential tool for Node.js developers needing to route HTTPS requests through HTTP or HTTPS proxies. Comparing version 1.0.0 with its prior stable release, 0.3.6, reveals subtle yet impactful changes. Both versions maintain the core functionality of enabling HTTPS proxying via an http.Agent implementation, crucial when applications require secure communication through intermediary proxy servers. They share common dependencies like "debug" and "extend," aiding in debugging and object extension respectively, and use the same development dependencies such as Mocha for testing and Semver for version management.
A significant difference lies in the "agent-base" dependency. Version 1.0.0 updates this dependency to version 2, while version 0.3.6 relies on version "~1.0.1." This update likely introduces API changes or bug fixes within "agent-base" that developers should be aware of, potentially affecting how the proxy agent interacts with the underlying HTTP/HTTPS connection. Developers upgrading from 0.3.6 should carefully review the "agent-base" changelog to ensure compatibility. The package description remains consistent, emphasizing its role as an http.Agent for HTTPS proxies. Both versions are licensed under the permissive MIT license, offering flexibility in usage. The package is maintained by Nathan Rajlich, with the code repository hosted on GitHub, inviting contributions and issue reporting from the developer community. Released within days of each other in July 2015, these versions illustrate ongoing maintenance and potential improvements to this valuable package.
All the vulnerabilities related to the version 1.0.0 of the package
Denial of Service in https-proxy-agent
Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().
Update to version 2.2.0 or later.
Machine-In-The-Middle in https-proxy-agent
Versions of https-proxy-agent prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.
Upgrade to version 3.0.0 or 2.2.3.
semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
