Skip to content
OpenAdvisories
Medium · 6.1 GHSA-pc5p-h8pf-mvwp

Machine-In-The-Middle in https-proxy-agent

Published Apr 16, 2020 · Updated Nov 1, 2023 · Assigned by GHSA

Description

Versions of `https-proxy-agent` prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.

## Recommendation

Upgrade to version 3.0.0 or 2.2.3.

Affected packages

EcosystemPackageAffectedFixedRecord
npm https-proxy-agent < 2.2.3 2.2.3 GHSA-pc5p-h8pf-mvwp

References