CVE-2018-3739: Critical severity Https-proxy-agent Project Https-proxy-agent Node.js vulnerability
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Other sources
Node.js https-proxy-agent module is vulnerable to a denial of service, caused by passing the auth option to the Buffer constructor without proper sanitization. A remote attacker could exploit this vulnerability using the auth parameter to leak memory and cause the application to consume all available CPU resources.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-3739?
CVE-2018-3739 is a vulnerability in the Node.js https-proxy-agent module that allows a remote attacker to exploit the auth parameter and cause a denial of service by consuming all available memory.
How does CVE-2018-3739 affect Https-proxy-agent?
CVE-2018-3739 affects versions up to and excluding 2.2.0 of the Https-proxy-agent module, allowing an attacker to leak memory and cause a denial of service.
What is the severity of CVE-2018-3739?
CVE-2018-3739 has a severity rating of 9.1 (Critical).
How can I fix CVE-2018-3739?
To fix CVE-2018-3739, you should update your Https-proxy-agent module to version 2.2.1 or higher.
Are there any references for CVE-2018-3739?
Yes, you can find references for CVE-2018-3739 at the following links: [HackerOne report](https://hackerone.com/reports/319532), [IBM X-Force report](https://exchange.xforce.ibmcloud.com/vulnerabilities/143928), [IBM Support page](https://www.ibm.com/support/pages/node/7057377).