Description
When using axios, its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.
Recommendation
Update the follow-redirects package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.15.5
- Patched version(s): 1.15.6
References
- GHSA-cxjh-pqwp-8mfp
- fetch.spec.whatwg.org
- hackerone.com
- lists.fedoraproject.org
- CVE-2024-28849
- CWE-200
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- Improper Verification of Cryptographic Signature in node-forge - CVE-2022-24772
- Remote Code Execution on click of <a> Link in markdown preview - CVE-2024-49362
- XSS vulnerability that affects bootstrap (GHSA-3mgp-fx93-9xv5) - CVE-2018-20676
- Follow Redirects improperly handles URLs in the url.parse() function - CVE-2023-26159
- Tags:
- npm
- follow-redirects
Anything's wrong? Let us know Last updated on April 02, 2024