Memory Exposure in tunnel-agent

Description

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Recommendation

Update the tunnel-agent package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.6.0
• Patched version(s): 0.6.0

References

• GHSA-xc7v-wxcw-j472
• www.npmjs.com
• CWE-200
• OWASP 2021-A1

Related Issues

• Memory exhaustion in SvelteKit remote form deserialization (experimental only) - Vulnerability
• devalue affected by CPU and memory amplification from sparse arrays - Vulnerability
• Potential memory exposure in dns-packet - CVE-2021-23386
• Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - CVE-2026-41264

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

tunnel-agent