node-http-proxy

[kasasusmitha12]

We need to upgrade this version "1.15.6" . We have found a vulnerability in the "follow-redirects" package. Please consider upgrading and releasing new release notes for the package. Here I am providing CVE and Vendor Advisories
CVE - https://nvd.nist.gov/vuln/detail/CVE-2024-28849
Vendor Advisories -https://github.com/follow-redirects/follow-redirects/releases/tag/v1.15.6
-follow-redirects/follow-redirects@c4f847f
-GHSA-cxjh-pqwp-8mfp

[chimurai]

Updating your dependency lock-file should resolve this issue.

follow-redirects is configured with ^ so you should be able to get the minor versions

node-http-proxy/package.json

Lines 14 to 18 in 9b96cd7

	"dependencies": {
	"eventemitter3": "^4.0.0",
	"requires-port": "^1.0.0",
	"follow-redirects": "^1.0.0"
	},

[ravin00]

Like the above comment updating the lock file should solve the issue