Denial of Service in https-proxy-agent

严重 9.1CVE-2018-3739 · GHSA-8g7p-74h8-hg48 · Published 07/06/2018 · updated 17/06/2026

要点

CVE-2018-3739 是影响 https-proxy-agent (https-proxy-agent project), https-proxy-agent 的严重 (CVSS 9.1)漏洞。
未来 30 天内被利用的概率（EPSS）：1.7%，高于 77.8% 的漏洞。
修复：升级到 2.2.0 或更高版本。

Package	Affected versions	Patched versions
https-proxy-agent https-proxy-agent_project	`< 2.2.0`	`2.2.0`
https-proxy-agent npm	`< 2.2.0`	`2.2.0`

Description

Versions of https-proxy-agent before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().

Recommendation

Update to version 2.2.0 or later.

NVD description

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).

References

nvd.nist.gov/vuln/detail/CVE-2018-3736 · ADVISORY
TooTallNate/node-https-proxy-agent commit 1c24219 · WEB
hackerone.com/reports/319532 · WEB
TooTallNate/node-https-proxy-agent · PACKAGE
GitHub Advisory GHSA-8g7p-74h8-hg48 · ADVISORY
npmjs.com/advisories/593 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free