create-react-app Security vulnerability of medium severity in react script module for inflight transitive dependency

When i create a create react app i found a medium security vulnerability in inflight library https://www.npmjs.com/package/inflight?activeTab=versions, the details are below Veracode Software Composition Analysis(SCA) scan screenshot SRCCLR-SID-41137 Memory Leak: inflight is vulnerable to a Memory Leak. The vulnerability is due to lack of restriction s on how many callbacks the library can concurrently support, which can result in a NodeJS out of heap memory crash. We scanned using a licensed version of veracode tool Inflight is no more maintained and react-script latest version 5.0.1 has this vulnerability Please let us know if this can be fixed or any work around

Aug 22 '23 11:08 wesco-vishalprasad

Any update on this?

Sep 12 '23 07:09 wesco-vishalprasad

I too required to fix this vulnerability

Sep 18 '23 16:09 ammusiva

Help me please

Oct 03 '23 19:10 diegoalbertopp

Any updates on this?

Oct 20 '23 12:10 avkamolov

Is anybody working on this?

Oct 31 '23 14:10 wesco-anurajka

Are you sure this comes from react-scripts? Check under Dependancy Graph section on the Veracode SCA scan. For me it came from eslint package and react scripts had no issue. If for anyone else it is the eslint package then here's how I sorted it out:

https://dev.to/thecodeinfluencer/possible-fix-inflight-reported-as-a-vulnerability-in-react-project-veracode-sca-2b1h

Nov 10 '23 07:11 thecodeinfluencer

npm ls inflight Also, this explanation may be useful: https://github.com/facebook/create-react-app/issues/11174#issue-935928547

Jan 23 '24 17:01 zhibirc

https://github.com/facebook/create-react-app/blob/main/package-lock.json#L15116

Jul 18 '24 07:07 famiclone