{"id":"GHSA-xc7v-wxcw-j472","aliases":["CLSA-2026-1773274561","CLSA-2026-1773274562","CLSA-2026-1773274564"],"status":"published","title":"Memory Exposure in tunnel-agent","description":"Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure.\n\nThis is exploitable if user supplied input is provided to the auth value and is a number.\n\nProof-of-concept:\n```js\nrequire('request')({\n  method: 'GET',\n  uri: 'http://www.example.com',\n  tunnel: true,\n  proxy:{\n    protocol: 'http:',\n    host:'127.0.0.1',\n    port:8080,\n    auth:USERSUPPLIEDINPUT // number\n  }\n});\n```\n\n\n## Recommendation\n\nUpdate to version 0.6.0 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2019-06-03T17:08:26Z","modified":"2026-10-15T09:47:28Z","fixes":[{"ecosystem":"npm","package":"tunnel-agent","fixed_in":["0.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"tunnel-agent","fixed_in":["0.3.0-tuxcare.1","0.4.0-tuxcare.1","0.4.3-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tunnel-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tunnel-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0-tuxcare.0"},{"fixed":"0.3.0-tuxcare.1"}]}],"versions":["0.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tunnel-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0-tuxcare.0"},{"fixed":"0.4.0-tuxcare.1"}]}],"versions":["0.4.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tunnel-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.3-tuxcare.0"},{"fixed":"0.4.3-tuxcare.1"}]}],"versions":["0.4.3"]},{"source":"osv","ecosystem":"npm","package":"tunnel-agent","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]}],"references":[{"url":"https://github.com/request/tunnel-agent/commit/9ca95ec7219daface8a6fc2674000653de0922c0","tags":["web"]},{"url":"https://www.npmjs.com/advisories/598","tags":["web"]},{"url":"https://gist.github.com/ChALkeR/fd6b2c445834244e7d440a043f9d2ff4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xc7v-wxcw-j472"}],"sources":{"ghsa":[{"id":"GHSA-xc7v-wxcw-j472","title":"Memory Exposure in tunnel-agent","description":"Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure.\n\nThis is exploitable if user supplied input is provided to the auth value and is a number.\n\nProof-of-concept:\n```js\nrequire('request')({\n  method: 'GET',\n  uri: 'http://www.example.com',\n  tunnel: true,\n  proxy:{\n    protocol: 'http:',\n    host:'127.0.0.1',\n    port:8080,\n    auth:USERSUPPLIEDINPUT // number\n  }\n});\n```\n\n\n## Recommendation\n\nUpdate to version 0.6.0 or later.","status":"published","published":"2019-06-03T17:08:26Z","modified":"2023-01-09T05:01:22Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"CLSA-2026-1773274561","title":"TuxCare security update for tunnel-agent (1 CVE)","description":"TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.660708495Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773274562","title":"TuxCare security update for tunnel-agent (1 CVE)","description":"TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.4.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.165685407Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773274564","title":"TuxCare security update for tunnel-agent (1 CVE)","description":"TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.4.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.714052855Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"GHSA-xc7v-wxcw-j472","title":"Memory Exposure in tunnel-agent","description":"Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure.\n\nThis is exploitable if user supplied input is provided to the auth value and is a number.\n\nProof-of-concept:\n```js\nrequire('request')({\n  method: 'GET',\n  uri: 'http://www.example.com',\n  tunnel: true,\n  proxy:{\n    protocol: 'http:',\n    host:'127.0.0.1',\n    port:8080,\n    auth:USERSUPPLIEDINPUT // number\n  }\n});\n```\n\n\n## Recommendation\n\nUpdate to version 0.6.0 or later.","status":"published","published":"2019-06-03T17:08:26Z","modified":"2020-08-31T18:29:19Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}