node-http-proxy icon indicating copy to clipboard operation
node-http-proxy copied to clipboard
verified publisher icon http-party

chore: upgrade follow-redirects package in order to fix security vulnerability

Open GuusDeGraeve opened this issue 1 year ago • 2 comments

Versions of the follow-redirects package prior to version 1.15.4 are vulnerable to improper input validation. This PR upgrades the dependency, without changing the lockfile version.

See CVE-2023-26159

This should fix https://github.com/http-party/node-http-proxy/issues/1657

GuusDeGraeve avatar Feb 23 '24 12:02 GuusDeGraeve

@jcrugzz would you have the time to look at this PR and possibly include it in a new release? The dependency is vulnerable and since this package is a sub dependency of many, it is "blocking" upgrades and forcing manual overrides (not ideal).

GuusDeGraeve avatar Feb 27 '24 11:02 GuusDeGraeve

This project node-http-proxy hasn't had any activity or maintenance at all in over 4 years, but has 98 open pull requests and about 15 million downloads per week. Is anybody thinking of taking over and doing some basic maintenance? (I love and greatly appreciate this package and use it all the time.)

williamstein avatar Mar 23 '24 18:03 williamstein