Description
Versions of `https-proxy-agent` prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.
## Recommendation
Upgrade to version 3.0.0 or 2.2.3.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | https-proxy-agent | < 2.2.3 | 2.2.3 | GHSA-pc5p-h8pf-mvwp |