sockjs / sockjs-client

WebSocket emulation - Javascript client
MIT License
8.45k stars 1.3k forks source link

CVE-2021-3664 - update url-parse to >= 1.5.2 #550

Closed peasandwell closed 3 years ago

peasandwell commented 3 years ago

A new vulnerability has been reported against url-parse@1.5.1:

The suggested fix is to update url-parse to version 1.5.2.

iorrah commented 3 years ago

This thread on Huntr confirms that version 1.5.2 addresses the issue:

drjauss commented 3 years ago

Just opened a PR solving this, thank you both! https://github.com/sockjs/sockjs-client/pull/551

Hope this gets solved soon.

drjauss commented 3 years ago

Hi @majek @brycekahle, 👋

Could you both help us check this out?

drjauss commented 3 years ago

bump