Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ladjs/superagent
master @ 3ef3676
9
Fixes
1
CVEs
HIGH
Peak severity
22.2%
Coverage
Highlights
Information Disclosure: 4 prior fixes. Scrutinize any change in this area.
lib/node/index.js: most-fixed (6 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: Sensitive request parameters, Host headers, and authentication cookies are prone to leaking to untrusted third-party domains during automated HTTP redirects unless explicitly stripped or cleared during the transition to a new target host.
Denial of Service: Uncaught network errors and ZIP bombs (excessive compression) can trigger unhandled exceptions or resource exhaustion. Unhandled error event emissions without registered listeners or failing to destroy hung connections will cause immediate Node.js process crashes.
Denial of Service: Repeatedly attaching listeners on request or response streams via '.on' rather than '.once' leads to memory leaks and eventual process exhaustion over long-lived sessions.