Description
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Thank you.
Metadata
Metadata
Assignees
Labels
No labels
Activity
ryanomor commentedon Jan 19, 2024
@indexzero @cronopio @jcrugzz @yawnt Any updates on if this is being addressed (#1571)?
scarton commentedon Jan 19, 2024
FYI - I got around this for now by overriding the follow-redirects library version in my package.json:
"overrides": {
"http-server": {
"http-proxy": {
"follow-redirects": "^1.15.5"
}
}
},
kanticsurapaneni commentedon Jan 24, 2024
Hello, The issue still seems to exist. Latest version of http-proxy (1.18.1) is still referencing old version of follow-redirects 1.0.0. Snyk is still reporting this vulnerability because of the reference to follow-redirects 1.0.0 version in package-lock.json being generated. Can you please take a look at this and fix the package.json for http-proxy module?

Reference: https://github.com/http-party/node-http-proxy/blob/master/package.json