Denial of Service in https-proxy-agent

CRITICO 9.1CVE-2018-3739 · GHSA-8g7p-74h8-hg48 · Published 07/06/2018 · updated 17/06/2026

In breve

CVE-2018-3739 è una vulnerabilità CRITICO (CVSS 9.1) che riguarda https-proxy-agent (https-proxy-agent project), https-proxy-agent.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.7%, superiore al 77.8% delle vulnerabilità.
Correzione: aggiornare a 2.2.0 o successiva.

Package	Affected versions	Patched versions
https-proxy-agent https-proxy-agent_project	`< 2.2.0`	`2.2.0`
https-proxy-agent npm	`< 2.2.0`	`2.2.0`

Description

Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().

Recommendation

Update to version 2.2.0 or later.

NVD description

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).

References

nvd.nist.gov/vuln/detail/CVE-2018-3736 · ADVISORY
TooTallNate/node-https-proxy-agent commit 1c24219 · WEB
hackerone.com/reports/319532 · WEB
TooTallNate/node-https-proxy-agent · PACKAGE
GitHub Advisory GHSA-8g7p-74h8-hg48 · ADVISORY
npmjs.com/advisories/593 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free