http-party/node-http-proxy

Please fix version of Library "follow-redirects" to eliminate CVE-2023-26159 issue

scarton opened this issue · 3 comments

scarton commented

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Thank you.

ryanomor commented

@indexzero @cronopio @jcrugzz @yawnt Any updates on if this is being addressed (#1571)?

scarton commented

FYI - I got around this for now by overriding the follow-redirects library version in my package.json:

"overrides": {
"http-server": {
"http-proxy": {
"follow-redirects": "^1.15.5"
}
}
},

  • 🚀2
kanticsurapaneni commented

Hello, The issue still seems to exist. Latest version of http-proxy (1.18.1) is still referencing old version of follow-redirects 1.0.0. Snyk is still reporting this vulnerability because of the reference to follow-redirects 1.0.0 version in package-lock.json being generated. Can you please take a look at this and fix the package.json for http-proxy module?
Reference: https://github.com/http-party/node-http-proxy/blob/master/package.json
npm-issue

  • 👍1