Https-proxy-agent version 2.1.1 is a minor update to the popular Node.js library designed to facilitate HTTPS connections via an HTTP or HTTPS proxy. This tool is essential for developers building applications that need to route secure traffic through intermediaries, enabling features like load balancing, security monitoring, and access control. The core functionality remains consistent with the previous stable version, 2.1.0, offering a seamless http.Agent implementation for HTTPS requests.
The primary difference between the two versions lies in their dependencies. Version 2.1.1 bumps the debug dependency from version 2.4.1 to version 3.1.0. While this might seem like a small change, upgrading the debug package can bring performance improvements, bug fixes, and new debugging features that can be invaluable during development and troubleshooting. Developers leveraging the debug package for logging and tracing will benefit from these enhancements.
Both versions share the same core architecture, utilizing agent-base for agent functionality, mocha for testing and proxy for local proxy testing. The MIT license ensures flexibility in usage, and the active repository on GitHub indicates ongoing maintenance and community support. Nathan Rajlich remains the author. The update from 2.1.0 to 2.1.1 is a worthwhile upgrade for developers seeking the latest debugging capabilities and potential performance enhancements within their HTTPS proxy setups while they keep benefiting from a strong testing suite to perform local tests.
All the vulnerabilities related to the version 2.1.1 of the package
Denial of Service in https-proxy-agent
Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().
Update to version 2.2.0 or later.
Machine-In-The-Middle in https-proxy-agent
Versions of https-proxy-agent prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.
Upgrade to version 3.0.0 or 2.2.3.
