p PatchFirst

CVE-2023-26159

CVE-2023-26159

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

CVSS 7.3 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • follow-redirects

    Versions
    • ≥ 0, < 1.15.4: Affected (semver)

    Update to 1.15.4

  • node-follow-redirects Debian:12

    Versions
    • 1.15.11+~1.14.4-1
    • 1.15.11+~1.14.4-2
    • 1.15.2+~1.14.1-1
    • 1.15.3+~1.14.2-1
    • 1.15.6+~1.14.4-1
    • 1.15.6+~1.14.4-2
    • 1.15.9+~1.14.4-1
    • 1.16.0+~1.14.4-1
    • 1.16.0+~1.14.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.15.6+~1.14.4-1

    Update to 1.15.6+~1.14.4-1

  • node-follow-redirects Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.15.6+~1.14.4-1

    Update to 1.15.6+~1.14.4-1

  • follow-redirects npm

    Affected ranges
    • SEMVER: < 1.15.4

    Update to 1.15.4

  • node-follow-redirects Ubuntu:Pro:18.04:LTS

    Versions
    • 1.2.4-1
    Affected ranges
    • ECOSYSTEM: < 1.2.4-1ubuntu0.18.04.1~esm1

    Update to 1.2.4-1ubuntu0.18.04.1~esm1

  • node-follow-redirects Ubuntu:Pro:20.04:LTS

    Versions
    • 1.2.4-1
    Affected ranges
    • ECOSYSTEM: < 1.2.4-1ubuntu0.20.04.1~esm1

    Update to 1.2.4-1ubuntu0.20.04.1~esm1

  • node-follow-redirects Ubuntu:Pro:22.04:LTS

    Versions
    • 1.13.1-1
    • 1.14.5-1
    • 1.14.7+~1.13.1-1
    • 1.14.8+~1.14.0-1
    • 1.14.9+~1.14.1-1
    Affected ranges
    • ECOSYSTEM: < 1.14.9+~1.14.1-1ubuntu0.1~esm1

    Update to 1.14.9+~1.14.1-1ubuntu0.1~esm1

Original sources

Check your server →