Description
When using axios, its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.
Recommendation
Update the follow-redirects package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.15.5
- Patched version(s): 1.15.6
References
- GHSA-cxjh-pqwp-8mfp
- fetch.spec.whatwg.org
- hackerone.com
- lists.fedoraproject.org
- CVE-2024-28849
- CWE-200
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- Follow Redirects improperly handles URLs in the url.parse() function - CVE-2023-26159
- Happy DOM: VM Context Escape can lead to Remote Code Execution - CVE-2025-61927
- Improper Verification of Cryptographic Signature in node-forge - CVE-2022-24772
- Exposure of sensitive information in follow-redirects - CVE-2022-0155
- Tags:
- npm
- follow-redirects
Anything's wrong? Let us know Last updated on April 02, 2024