New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

node-http-proxy #1663

Open

kasasusmitha12 opened this issue Apr 2, 2024 · 1 comment

kasasusmitha12 commented Apr 2, 2024

We need to upgrade this version "1.15.6" . We have found a vulnerability in the "follow-redirects" package. Please consider upgrading and releasing new release notes for the package. Here I am providing CVE and Vendor Advisories
CVE - https://nvd.nist.gov/vuln/detail/CVE-2024-28849
Vendor Advisories -https://github.com/follow-redirects/follow-redirects/releases/tag/v1.15.6
-follow-redirects/follow-redirects@c4f847f
-GHSA-cxjh-pqwp-8mfp

The text was updated successfully, but these errors were encountered:

Contributor

chimurai commented Apr 2, 2024

Updating your dependency lock-file should resolve this issue.

follow-redirects is configured with ^ so you should be able to get the minor versions

node-http-proxy/package.json

Lines 14 to 18 in 9b96cd7

    
           "dependencies": { 
        
             "eventemitter3": "^4.0.0", 
        
             "requires-port": "^1.0.0", 
        
             "follow-redirects": "^1.0.0" 
        
           },

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment