Vulnerability GHSA-pw2r-vq6v-hr8c
Medium Risk
MEDIUM RISK
CVSS Score: 5.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 years ago
February 10, 2022 at 12:00 AM UTC
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
0.0.1 - 1.14.7
0.0.1 - 1.14.7
Summary
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Details
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
3 hours ago
follow-redirects array-form headers bypass cross-origin credential stripping
1.16.0 GHSA-q3jh-wrc6-jgq8
1.16.0 GHSA-q3jh-wrc6-jgq8
High Risk
3 hours ago
follow-redirects sensitiveHeaders regex escaping can expose credential headers
1.16.0 GHSA-8r9p-f939-6h3c
1.16.0 GHSA-8r9p-f939-6h3c
Medium Risk
6 months ago
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
0.0.1 - 1.15.11 GHSA-r4q5-vmmm-2653
0.0.1 - 1.15.11 GHSA-r4q5-vmmm-2653
Medium Risk
2 years ago
follow-redirects' Proxy-Authorization header kept across hosts
0.0.1 - 1.15.5 GHSA-cxjh-pqwp-8mfp
0.0.1 - 1.15.5 GHSA-cxjh-pqwp-8mfp
Medium Risk
2 years ago
Follow Redirects improperly handles URLs in the url.parse() function
0.0.1 - 1.15.3 GHSA-jchw-25xp-jwwc
0.0.1 - 1.15.3 GHSA-jchw-25xp-jwwc
Impacted packages
Timeline
Published
4 years ago
February 10, 2022 at 12:00 AM UTC
Fixed (1.14.8)
4 years ago
February 08, 2022 at 11:04 AM UTC
Last Modified
1 month ago
September 10, 2026 at 03:49 AM UTC