The https-proxy-agent npm package, a crucial tool for routing HTTPS requests through HTTP(S) proxies, saw a significant update between versions 1.0.0 and 2.0.0. Version 2.0.0, released in June 2017, reflects a modernized dependency set compared to the July 2015 release of version 1.0.0. Key differences lie in the updated dependencies; for instance, debug moves from a broad "2" to a more specific "^2.4.1", and agent-base evolves from "2" to "^4.1.0". This indicates a shift towards greater stability and potentially new features or bug fixes leveraged from newer versions of underlying libraries.
Furthermore, version 1.0.0 utilized extend at version "3", which is completely removed in version 2.0.0, suggesting a possible refactoring of the codebase to eliminate the need for this utility. Development dependencies also show changes: mocha updates from "2" to "^3.4.2", proxy sees a minor version bump from "~0.2.3" to "^0.2.4", and semver, present in 1.0.0, completely disappears in 2.0.0, implying changes in testing or build processes. Developers upgrading should carefully review these dependency changes to ensure compatibility within their existing projects and to leverage the updated features and improvements introduced in the newer version, specifically related to debug functionalities and agent base. The removal of extend might impact code relying on that specific dependency directly.
All the vulnerabilities related to the version 2.0.0 of the package
Denial of Service in https-proxy-agent
Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().
Update to version 2.2.0 or later.
Machine-In-The-Middle in https-proxy-agent
Versions of https-proxy-agent prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.
Upgrade to version 3.0.0 or 2.2.3.
