Denial of Service in https-proxy-agent

KRITISCH 9.1CVE-2018-3739 · GHSA-8g7p-74h8-hg48 · Published 07/06/2018 · updated 17/06/2026

Kurz gesagt

CVE-2018-3739 ist eine Schwachstelle (KRITISCH (CVSS 9.1)) in https-proxy-agent (https-proxy-agent project), https-proxy-agent.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.7%, höher als bei 77.8% aller Schwachstellen.
Abhilfe: auf 2.2.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
https-proxy-agent https-proxy-agent_project	`< 2.2.0`	`2.2.0`
https-proxy-agent npm	`< 2.2.0`	`2.2.0`

Description

Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().

Recommendation

Update to version 2.2.0 or later.

NVD description

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).

References

nvd.nist.gov/vuln/detail/CVE-2018-3736 · ADVISORY
TooTallNate/node-https-proxy-agent commit 1c24219 · WEB
hackerone.com/reports/319532 · WEB
TooTallNate/node-https-proxy-agent · PACKAGE
GitHub Advisory GHSA-8g7p-74h8-hg48 · ADVISORY
npmjs.com/advisories/593 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free