Lookup for vulnerable packages by Package URL.
| Purl | pkg:npm/https-proxy-agent@0.1.0 |
|---|
| Type | npm |
|---|
| Namespace | |
|---|
| Name | https-proxy-agent |
|---|
| Version | 0.1.0 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 2.2.3 |
|---|
| Latest_non_vulnerable_version | 2.2.3 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-hs7x-zfzt-uyak |
| vulnerability_id |
VCID-hs7x-zfzt-uyak |
| summary |
Machine-In-The-Middle in https-proxy-agent
Versions of `https-proxy-agent` prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.
## Recommendation
Upgrade to version 3.0.0 or 2.2.3. |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-pc5p-h8pf-mvwp, GMS-2020-738
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hs7x-zfzt-uyak |
|
| 1 |
| url |
VCID-zcad-naym-e3gc |
| vulnerability_id |
VCID-zcad-naym-e3gc |
| summary |
Out-of-bounds Read
https-proxy-agent passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the `auth` parameter (e.g. JSON). |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-3739 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00433 |
| scoring_system |
epss |
| scoring_elements |
0.63109 |
| published_at |
2026-06-07T12:55:00Z |
|
| 1 |
| value |
0.00433 |
| scoring_system |
epss |
| scoring_elements |
0.63119 |
| published_at |
2026-06-06T12:55:00Z |
|
| 2 |
| value |
0.00433 |
| scoring_system |
epss |
| scoring_elements |
0.63111 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00433 |
| scoring_system |
epss |
| scoring_elements |
0.63066 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-3739 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-3739, GHSA-8g7p-74h8-hg48
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zcad-naym-e3gc |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | 4.5 |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:npm/https-proxy-agent@0.1.0 |
|---|