Denial of Service in https-proxy-agent

CRÍTICO 9.1CVE-2018-3739 · GHSA-8g7p-74h8-hg48 · Published 07/06/2018 · updated 17/06/2026

Em resumo

CVE-2018-3739 é uma vulnerabilidade CRÍTICO (CVSS 9.1) que afeta https-proxy-agent (https-proxy-agent project), https-proxy-agent.
Chance de exploração nos próximos 30 dias (EPSS): 1.7%, maior que 77.8% das vulnerabilidades.
Correção: atualize para 2.2.0 ou posterior.

Package	Affected versions	Patched versions
https-proxy-agent https-proxy-agent_project	`< 2.2.0`	`2.2.0`
https-proxy-agent npm	`< 2.2.0`	`2.2.0`

Description

Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().

Recommendation

Update to version 2.2.0 or later.

NVD description

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).

References

nvd.nist.gov/vuln/detail/CVE-2018-3736 · ADVISORY
TooTallNate/node-https-proxy-agent commit 1c24219 · WEB
hackerone.com/reports/319532 · WEB
TooTallNate/node-https-proxy-agent · PACKAGE
GitHub Advisory GHSA-8g7p-74h8-hg48 · ADVISORY
npmjs.com/advisories/593 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free