Exposure of Sensitive Information in simple-get

Description

In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially resulting in an exposure of the session cookie to a third party.

Recommendation

Update the simple-get package to the latest compatible version. Followings are version details:

• Affected version(s): **< 2.8.2

  >= 3.0.0, < 3.1.1

  = 4.0.0**

• Patched version(s): **2.8.2

  3.1.1

  4.0.1**

References

• GHSA-wpg7-2c88-r8xv
• huntr.dev
• CVE-2022-0355
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• min-document vulnerable to prototype pollution - CVE-2025-57352
• Vite bypasses server.fs.deny when using ?raw?? - CVE-2025-30208
• GetmeUK ContentTools Cross-Site Scripting (XSS) - CVE-2025-2699
• node-gettext vulnerable to Prototype Pollution - CVE-2024-21528

Tags:

npm

simple-get