# https-proxy-agent man-in-the-middle via improper TLS enforcement

Source: https://junglewise.ai/threats/https-proxy-agent-man-in-the-middle-via-improper-tls-enforcement-39e8db63  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-04-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2020-04-16

https-proxy-agent is a Node.js library used to proxy HTTPS connections through HTTP proxies. The vulnerability allows an attacker with access to the proxy server to intercept encrypted communications by exploiting improper TLS enforcement when the proxy returns non-200 HTTP status codes, potentially exposing credentials and other sensitive data.

Technologies: [https-proxy-agent (npm)](https://junglewise.ai/threats/technologies/https-proxy-agent). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 16 April 2020.

**Which products and versions are affected?** https-proxy-agent (npm) before 2.2.3.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected?** Check whether you run https-proxy-agent (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a man-in-the-middle flaw in https-proxy-agent (CWE-300) where the library fails to properly enforce TLS when the HTTP proxy server responds with a status code other than 200. An attacker with network access to the proxy server can downgrade the connection to unencrypted HTTP, allowing interception of sensitive data including credentials and application payloads. The vulnerability affects all versions prior to 2.2.3 and was fixed by using an EventEmitter to properly replay failed proxy connect requests instead of attempting to forward them directly. The fix ensures the node core HTTP client does not write requests intended for the destination server to the proxy server when a non-200 response is received.

## Affected products

- npm https-proxy-agent before 2.2.3

## Timeline

- 2020-04-16: disclosed

## References

- [https://github.com/TooTallNate/node-https-proxy-agent/commit/36d8cf509f877fa44f4404fce57ebaf9410fe51b](https://github.com/TooTallNate/node-https-proxy-agent/commit/36d8cf509f877fa44f4404fce57ebaf9410fe51b)
- [https://hackerone.com/reports/541502](https://hackerone.com/reports/541502)

## Related threats

- [https-proxy-agent denial of service](https://junglewise.ai/threats/https-proxy-agent-denial-of-service-14e827ec)
- [https-proxy-agent denial of service via unsanitized proxy options](https://junglewise.ai/threats/cve-2018-3739-https-proxy-agent-denial-of-service-via-unsanitized-proxy-options)