http-proxy denial of service vulnerability

[broksonic21]

Issue details

There is an open ticket for yargs-parser, but a new DOS for http-proxy showed up today:

│ High          │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ http-proxy                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ browser-sync [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ browser-sync > http-proxy                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1486                            │
└───────────────┴──────────────────────────────────────────────────────────────┘```

### Steps to reproduce/test case

add browser-sync to package.json, `npm install`, `npm audit`

### Please specify which version of Browsersync, node and npm you're running

- Browsersync - 2.26.7
- Node        - v14.2.0
- Npm         - 6.14.5

[fredericpfisterer]

Patch is available now. Can somebody update http-proxy package ?

[ainsleyclark]

Any movement on this?

[vidhya03]

I got this in my project using browser-sync 2.26.7
High Denial of Service
Package http-proxy
Patched in >=1.18.1
Dependency of browser-sync [dev]
Path browser-sync > http-proxy
More info https://npmjs.com/advisories/1486

[denisbrodbeck]

The maintainers of http-proxy fixed the issue in this commit.
They also dropped support for Node 6 here, while browser-sync still supports Node 6.

[blachawk]

What do we do now to resolve this? Feels like we are all at a crossroad with no guard at the intersection.

[mattshirlaw-finocomp]

+1 would also like to know whether there is a plan to fix this.

[edwardjosephbennett]

@shakyShane Is there a chance we can get this update merged into an update? Thanks :)

[kahlan88]

Would be great to get this merged soon :-) For now I'll set resolutions in my package.json, but would be awesome.

[thasmo]

Any update on this, @shakyShane?

[jeffschwartz]

Just asking due to no responses but Is browser-sync dead?

[kahlan88]

judging by latest commit, which was 14 months ago; it might be

[jeffschwartz]

@kahlan88 I was thinking the same thing. Unfortunately my node app uses browsersync. Are you aware of a suitable alternative? Have you tried the forked repo requesting a pull request to fix the issue?

[kahlan88]

@kahlan88 I was thinking the same thing. Unfortunately my node app uses browsersync. Are you aware of a suitable alternative? Have you tried the forked repo requesting a pull request to fix the issue?

You can set resolutions in the package.json file, based on vulnerabilities in the yarn audit command.

Like:

  "resolutions": {
    "http-proxy": "^1.18.1",
    "yargs-parser": "^13.1.2"
  }

Re-run yarn audit browser-sync vulnerabilities should disappear.
If you want to get rid of any other warnings - I think it's best to still first check whether there are any upgrades to packages they are caused by.

Hope that helps!

[joelspadin]

Are you aware of a suitable alternative?

@jeffschwartz I recently switched to using https://www.snowpack.dev/ for a project that had been using browsersync. I found it fairly easy to set up and it supports hot module reloading so the experience is pretty similar to browsersync but with some added bonuses like fixing up node_modules imports to work in the browser.

[kahlan88]

@jeffschwartz if you look at #1768 - I think it's just been fixed :-) I will certainly try it tomorrow

[jeffschwartz]

I was afraid that I'd have to delay the next release of my project so this is awesome news. Thanks to everyone getting this done for the community ♥👍👏.

[jeffschwartz]

@kahlan88 yes, it's awesome and I will try later today and post a follow up. Thank you for your previous suggestion.

[jeffschwartz]

After running npm update npm audit reports 0 issues and I can also report that the release works for me. Again, thanks to everyone who made this happen.