We're aware of this issue with bcrypt and are currently working out what to do.
Node-RED 1.x still supports Node 8. Unfortunately bcrypt 5.x no longer supports Node 8. So we can't simply upgrade bcrypt in a minor release. We can only drop Node 8 support in a major version change. Our release plan has Node-RED 2.0 scheduled next April when we'll drop Node 8 and 10 at the same time (as they will both be out of maintenance by then).
We're currently evaluating whether to bring the 2.0 release forward and rearranging the whole release plan.
In mitigation, based on our initial evaluation, we don't believe this vulnerability is applicable to how we use the module. The vulnerability with bcrypt is with its handling of payloads > 256 bytes. Given we only use it for hashing passwords, it is exceeding unlikely that users will have >256 character passwords.
It is unfortunate that the crude nature of the npm audit scan means there's no way for us to explain this mitigation and get us unflagged.