Follow Redirects
Monthly
Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whenever an HTTP request follows a cross-domain redirect. The header-stripping regex at index.js:469-476 only covers `authorization`, `proxy-authorization`, and `cookie`, leaving headers such as `X-API-Key`, `X-Auth-Token`, and `Token` forwarded verbatim to the redirect destination. Because follow-redirects is the redirect-handling dependency for axios (105K+ GitHub stars), this flaw has broad reach across the Node.js ecosystem; no public exploit code has been identified at time of analysis, though a fully detailed GHSA advisory with a working attack scenario is publicly available.
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whenever an HTTP request follows a cross-domain redirect. The header-stripping regex at index.js:469-476 only covers `authorization`, `proxy-authorization`, and `cookie`, leaving headers such as `X-API-Key`, `X-Auth-Token`, and `Token` forwarded verbatim to the redirect destination. Because follow-redirects is the redirect-handling dependency for axios (105K+ GitHub stars), this flaw has broad reach across the Node.js ecosystem; no public exploit code has been identified at time of analysis, though a fully detailed GHSA advisory with a working attack scenario is publicly available.
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.