GHSA-xc7v-wxcw-j472
Memory Exposure in tunnel-agent
Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.
This is exploitable if user supplied input is provided to the auth value and is a number.
Proof-of-concept:
require('request')({
method: 'GET',
uri: 'http://www.example.com',
tunnel: true,
proxy:{
protocol: 'http:',
host:'127.0.0.1',
port:8080,
auth:USERSUPPLIEDINPUT // number
}
});
Recommendation
Update to version 0.6.0 or later.
What each source reports
GitHub AdvisoriesNo score
Memory Exposure in tunnel-agent
Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.
This is exploitable if user supplied input is provided to the auth value and is a number.
Proof-of-concept:
require('request')({
method: 'GET',
uri: 'http://www.example.com',
tunnel: true,
proxy:{
protocol: 'http:',
host:'127.0.0.1',
port:8080,
auth:USERSUPPLIEDINPUT // number
}
});
Recommendation
Update to version 0.6.0 or later.
- Record
GHSA-xc7v-wxcw-j472- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVCLSA-2026-1773274561No score
TuxCare security update for tunnel-agent (1 CVE)
TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.3.0-tuxcare.1.
- Record
CLSA-2026-1773274561- Updated
- 2026-11-02
OSVCLSA-2026-1773274562No score
TuxCare security update for tunnel-agent (1 CVE)
TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.4.0-tuxcare.1.
- Record
CLSA-2026-1773274562- Updated
- 2026-11-02
OSVCLSA-2026-1773274564No score
TuxCare security update for tunnel-agent (1 CVE)
TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.4.3-tuxcare.1.
- Record
CLSA-2026-1773274564- Updated
- 2026-11-02
OSVNo score
Memory Exposure in tunnel-agent
Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.
This is exploitable if user supplied input is provided to the auth value and is a number.
Proof-of-concept:
require('request')({
method: 'GET',
uri: 'http://www.example.com',
tunnel: true,
proxy:{
protocol: 'http:',
host:'127.0.0.1',
port:8080,
auth:USERSUPPLIEDINPUT // number
}
});
Recommendation
Update to version 0.6.0 or later.
- Record
GHSA-xc7v-wxcw-j472- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tunnel-agentnpm | before 0.6.0 | 0.6.0 |
tunnel-agentTuxCare:npm | 0.3.0-tuxcare.0 up to 0.3.0-tuxcare.1, plus listed versions 0.3.0 | 0.3.0-tuxcare.1 |
tunnel-agentTuxCare:npm | 0.4.0-tuxcare.0 up to 0.4.0-tuxcare.1, plus listed versions 0.4.0 | 0.4.0-tuxcare.1 |
tunnel-agentTuxCare:npm | 0.4.3-tuxcare.0 up to 0.4.3-tuxcare.1, plus listed versions 0.4.3 | 0.4.3-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-xc7v-wxcw-j472 is a vulnerability with no CVSS score yet in tunnel-agent, published June 3, 2019. No source lists public exploit code. Fixed in tunnel-agent 0.6.0.