CVE-2019-10196

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-665

Affected software

No affected versions have been published.

Timeline

Published: Mar 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101979.1A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters w CVE-2019-101986.5An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_re CVE-2019-101998.8It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use th CVE-2019-102007.2A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedul CVE-2019-10200017.5yard before 0.9.20 allows path traversal.CVE-2019-10200027.5Pterodactyl before 0.7.14 with 2FA allows credential sniffing.CVE-2019-10200035.4invenio-records before 1.2.2 allows XSS.CVE-2019-10200047.5Tridactyl before 1.16.0 allows fake key events.CVE-2019-10200055.4invenio-communities before 1.0.0a20 allows XSS.CVE-2019-10200066.1invenio-app before 1.1.1 allows host header injection.CVE-2019-10200075.4Dependency-Track before 3.5.1 allows XSS.CVE-2019-10200086.1stacktable.js before 1.0.4 allows XSS.