Skip to content

Please fix version of Library "follow-redirects" to eliminate CVE-2023-26159 issue #1657

@scarton

Description

@scarton

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Thank you.

Activity

ryanomor

ryanomor commented on Jan 19, 2024

@ryanomor

@indexzero @cronopio @jcrugzz @yawnt Any updates on if this is being addressed (#1571)?

scarton

scarton commented on Jan 19, 2024

@scarton
Author

FYI - I got around this for now by overriding the follow-redirects library version in my package.json:

"overrides": {
"http-server": {
"http-proxy": {
"follow-redirects": "^1.15.5"
}
}
},

kanticsurapaneni

kanticsurapaneni commented on Jan 24, 2024

@kanticsurapaneni

Hello, The issue still seems to exist. Latest version of http-proxy (1.18.1) is still referencing old version of follow-redirects 1.0.0. Snyk is still reporting this vulnerability because of the reference to follow-redirects 1.0.0 version in package-lock.json being generated. Can you please take a look at this and fix the package.json for http-proxy module?
Reference: https://github.com/http-party/node-http-proxy/blob/master/package.json
npm-issue

linked a pull request that will close this issue on Feb 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Participants

      @scarton@kanticsurapaneni@ryanomor

      Issue actions

        Please fix version of Library "follow-redirects" to eliminate CVE-2023-26159 issue · Issue #1657 · http-party/node-http-proxy