GHSA-8hp6-7rhf-3g4f: 
JavaScript vulnerability analysis and mitigation

Summary

In forward mode without an upstream proxy, or with a SOCKS upstream, a single request whose absolute-form URL contains a malformed percent-escape in the userinfo terminated the proxy-chain process. The HTTP-upstream and CONNECT paths are not affected.

Details

forward() in src/forward.ts and forwardSocks() in src/forward_socks.ts built the outbound request inside new Promise(async (resolve, reject) => ...). http.request(request.url) throws synchronously from decodeURIComponent when the URL userinfo is not valid percent-encoding. Because the executor was async, the throw became an unhandled promise rejection instead of a caught error, and Node's default --unhandled-rejections=throw terminated the process. Affected: all 2.x and 3.x releases before 3.0.2. Fixed in 3.0.2 (#737): the executors are synchronous, so the throw rejects the promise, the client receives a 500, and a requestFailed event is emitted.

Proof of concept

Start a proxy with no upstream (or a SOCKS upstream) and send:

GET http://%zz@example.com/ HTTP/1.1
Host: example.com

The process exits with URIError: URI malformed. A malformed escape in the password part (http://user:%zz@example.com/) has the same effect.

Impact

Denial of service (CWE-248, uncaught exception). Any client that passes proxy authentication, or any client when the proxy runs without authentication, can terminate the proxy process on demand. Affects operators of proxy-chain servers that accept plain HTTP requests.