Vulnerability GHSA-jchw-25xp-jwwc
Medium Risk
MEDIUM RISK
CVSS Score: 6.1
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
2 years ago
January 02, 2024 at 06:30 AM UTC
Follow Redirects improperly handles URLs in the url.parse() function
0.0.1 - 1.15.3
0.0.1 - 1.15.3
Summary
Follow Redirects improperly handles URLs in the url.parse() function
Details
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
3 hours ago
follow-redirects array-form headers bypass cross-origin credential stripping
1.16.0 GHSA-q3jh-wrc6-jgq8
1.16.0 GHSA-q3jh-wrc6-jgq8
High Risk
3 hours ago
follow-redirects sensitiveHeaders regex escaping can expose credential headers
1.16.0 GHSA-8r9p-f939-6h3c
1.16.0 GHSA-8r9p-f939-6h3c
Medium Risk
6 months ago
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
0.0.1 - 1.15.11 GHSA-r4q5-vmmm-2653
0.0.1 - 1.15.11 GHSA-r4q5-vmmm-2653
Medium Risk
2 years ago
follow-redirects' Proxy-Authorization header kept across hosts
0.0.1 - 1.15.5 GHSA-cxjh-pqwp-8mfp
0.0.1 - 1.15.5 GHSA-cxjh-pqwp-8mfp
Medium Risk
4 years ago
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
0.0.1 - 1.14.7 GHSA-pw2r-vq6v-hr8c
0.0.1 - 1.14.7 GHSA-pw2r-vq6v-hr8c
Impacted packages
Timeline
Published
2 years ago
January 02, 2024 at 06:30 AM UTC
Fixed (1.15.4)
2 years ago
December 30, 2023 at 05:28 PM UTC
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC