Denial of Service in https-proxy-agent

CRITICAL 9.1CVE-2018-3739 · GHSA-8g7p-74h8-hg48 · Published 07/06/2018 · updated 17/06/2026

In short

CVE-2018-3739 is a CRITICAL (CVSS 9.1) vulnerability affecting https-proxy-agent (https-proxy-agent project), https-proxy-agent.
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 77.8% of all vulnerabilities.
Fix: update to 2.2.0 or later.

Package	Affected versions	Patched versions
https-proxy-agent https-proxy-agent_project	`< 2.2.0`	`2.2.0`
https-proxy-agent npm	`< 2.2.0`	`2.2.0`

Description

Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().

Recommendation

Update to version 2.2.0 or later.

NVD description

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).

References

nvd.nist.gov/vuln/detail/CVE-2018-3736 · ADVISORY
TooTallNate/node-https-proxy-agent commit 1c24219 · WEB
hackerone.com/reports/319532 · WEB
TooTallNate/node-https-proxy-agent · PACKAGE
GitHub Advisory GHSA-8g7p-74h8-hg48 · ADVISORY
npmjs.com/advisories/593 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free