cve.bz

CVE-2018-3739

9.1 criticalEPSS 1.7%

Critical (9.1) in https-proxy-agent project https-proxy-agent. EPSS 1.7% chance of exploitation in the next 30 days. Fixed in https-proxy-agent 2.2.0.

https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).

Severity

CVSS 3.0

9.1 critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS
1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWEs
CWE-125, CWE-400
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-8g7p-74h8-hg48npmhttps-proxy-agent<2.2.02.2.0

References

Check your stackJSON