GHSA-74fj-2j2h-c42q high
Exposure of sensitive information in follow-redirects
Affected range
SEMVER: introduced 0; fixed 1.14.7Fixed versions: 1.14.7
follow-redirects
HTTP and HTTPS modules that follow redirects.
npm latest 1.16.0 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
1.16.0
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
5 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-r4q5-vmmm-2653 moderate
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
Affected range
SEMVER: introduced 0; fixed 1.16.0Fixed versions: 1.16.0
GHSA-cxjh-pqwp-8mfp moderate
follow-redirects' Proxy-Authorization header kept across hosts
Affected range
SEMVER: introduced 0; fixed 1.15.6Fixed versions: 1.15.6
GHSA-jchw-25xp-jwwc moderate
Follow Redirects improperly handles URLs in the url.parse() function
Affected range
SEMVER: introduced 0; fixed 1.15.4Fixed versions: 1.15.4
GHSA-pw2r-vq6v-hr8c moderate
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Affected range
SEMVER: introduced 0; fixed 1.14.8Fixed versions: 1.14.8