Memory Exposure

Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Proof-of-concept:
```js
require('request')({
  method: 'GET',
  uri: 'http://www.example.com',
  tunnel: true,
  proxy:{
    protocol: 'http:',
    host:'127.0.0.1',
    port:8080,
    auth:USERSUPPLIEDINPUT // number
  }
});
```

- [GitHub Commit #9ca95ec](https://github.com/request/tunnel-agent/commit/9ca95ec7219daface8a6fc2674000653de0922c0)
- [Proof of Concept](https://gist.github.com/ChALkeR/fd6b2c445834244e7d440a043f9d2ff4)


Memory Exposure


ReDoS

Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition.

## Proof of Concept

```
var expand = require('brace-expansion');
expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}');
```


ReDoS


Prototype Pollution

Versions of `deep-extend` before 0.5.1 are vulnerable to prototype pollution.


Prototype Pollution


Cryptographically Weak PRNG

Affected versions of `randomatic` generate random values using a cryptographically weak psuedo-random number generator. This may result in predictable values instead of random values as intended.


Cryptographically Weak PRNG


Prototype pollution

Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.

The `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.

This can be demonstrated like so:

```javascript
var Hoek = require('hoek');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';

var a = {};
console.log("Before : " + a.oops);
Hoek.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
```

This type of attack can be used to overwrite existing properties causing a potential denial of service.

Update to version 4.2.1, 5.0.3 or later.


Prototype pollution


Prototype Pollution

Versions of `lodash` before 4.17.5 are vulnerable to prototype pollution.

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.


Insufficient Entropy

Versions of `cryptiles` from version 3.1.0 through 3.1.2, and versions 4.0.0 to version 4.1.1 are vulnerable to insufficient entropy.  The `randomDigits` method generates digits that lack a perfect distribution over enough attempts.

Update to version 3.1.3 or 4.1.2 or later.

- [GitHub Issue](https://github.com/hapijs/cryptiles/issues/34)
- [security-wg](https://github.com/nodejs/security-wg/blob/master/vuln/npm/476.json)


Regular Expression Denial of Service

Versions of `sshpk` before 1.13.2 or 1.14.1 are vulnerable to regular expression denial of service when parsing crafted invalid public keys.

Update to version 1.13.2, 1.14.1 or later.

- https://github.com/joyent/node-sshpk/blob/v1.13.1/lib/formats/ssh.js#L17
- [HackerOne Report](https://hackerone.com/reports/319593)
- https://github.com/joyent/node-sshpk/commit/46065d38a5e6d1bccf86d3efb2fb83c14e3f9957


Regular Expression Denial of Service


Out-of-bounds Read

All versions of `stringstream` are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is being passed in to `stringstream`.

- [HackerOne Report](https://hackerone.com/reports/321670)
- https://github.com/mhart/StringStream/blob/v0.0.5/stringstream.js#L32


Out-of-bounds Read


Regular Expression Denial of Service

Affected versions of `tough-cookie` are susceptible to a regular expression denial of service.

The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.

If node was compiled using the `-DHTTP_MAX_HEADER_SIZE` however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.


Regular Expression Denial of Service

Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter.

As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.

Version 2.x.x: Update to version 2.6.9 or later.
Version 3.x.x: Update to version 3.1.0 or later.

- [Issue #501](https://github.com/visionmedia/debug/issues/501)
- [PR #504](https://github.com/visionmedia/debug/pull/504)


Out-of-bounds Read

Versions of `atob` before 2.1.0  uninitialized Buffers when number is passed in input on Node.js 4.x and below.


Cross-Site Scripting (XSS)

Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option.


ReDoS


Insufficient Entropy


Command Injection

All versions of `macaddress` are vulnerable to command injection. For this vulnerability to be exploited an attacker needs to control the `iface` argument to the `one` method.

- [HackerOne Report](https://hackerone.com/reports/319467)
- [Github PR #20](https://github.com/scravy/node-macaddress/pull/20)


Command Injection


Prototype pollution

Versions of `merge` before 1.2.1 are vulnerable to prototype pollution. The `merge.recursive` function can be tricked into adding or modifying properties of the Object prototype.


Prototype Pollution