Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
newrelic/csec-node-agent
main @ 036aa20
10
Fixes
0
CVEs
HIGH
Peak severity
87.5%
Coverage
Highlights
Denial of Service: 7 prior fixes. Scrutinize any change in this area.
lib/instrumentation-security/hooks/http/nr-http.js: most-fixed (3 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: The HTTP instrumentation hooks are highly vulnerable to crashing the host application due to missing null/empty checks on fuzzing headers prior to executing cryptographic functions. Additionally, unbounded memory consumption from HTTP request body chunks can lead to system-wide resource exhaustion.
Path Traversal: Unsanitized URL-encoded file paths allow attackers to bypass path validation mechanisms and manipulate arbitrary local files via write operations.
Denial of Service: Instrumenting database callbacks without verifying if they are already wrapped leads to infinite recursion, triggering stack overflows and causing the parent application to hang or crash.