Vulnerabilities

1 via 1 paths

Dependencies

Source

npm

Find, fix and prevent vulnerabilities in your code.

Severity
  • 1
Status
  • 1
  • 0
  • 0

low severity

Information Exposure

  • Vulnerable module: follow-redirects
  • Introduced through: follow-redirects@1.14.7

Detailed paths

  • Introduced through: follow-redirects@1.14.7
    Remediation: Upgrade to follow-redirects@1.14.8.

Overview

Affected versions of this package are vulnerable to Information Exposure due a leakage of the Authorization header from the same hostname during HTTPS to HTTP redirection. An attacker who can listen in on the wire (or perform a MITM attack) will be able to receive the Authorization header due to the usage of the insecure HTTP protocol which does not verify the hostname the request is sending to.

Remediation

Upgrade follow-redirects to version 1.14.8 or higher.

References