Please fix version of Library "follow-redirects" to eliminate CVE-2023-26159 issue

[scarton]

trafficstars

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Thank you.

[ryanomor]

@indexzero @cronopio @jcrugzz @yawnt Any updates on if this is being addressed (#1571)?

[scarton]

FYI - I got around this for now by overriding the follow-redirects library version in my package.json:

"overrides": { "http-server": { "http-proxy": { "follow-redirects": "^1.15.5" } } },

[kanticsurapaneni]

Hello, The issue still seems to exist. Latest version of http-proxy (1.18.1) is still referencing old version of follow-redirects 1.0.0. Snyk is still reporting this vulnerability because of the reference to follow-redirects 1.0.0 version in package-lock.json being generated. Can you please take a look at this and fix the package.json for http-proxy module? Reference: https://github.com/http-party/node-http-proxy/blob/master/package.json