1055 matches found
CVE-2026-116689
The Node.js HTTP and HTTPS client wrapper follow-redirects versions 1.16.0 through 1.16.2 is vulnerable to a security flaw where sensitiveHeaders arrays created in different JavaScript realms are incorrectly discarded because the library uses instanceof Array instead of Array.isArray(). This allo...
EUVD-2026-111347
The strapi/strapi Core Admin / Webhook Runner package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target...
CVE-2026-118172
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The vulnerability exists because the webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary chec...
httpdoom
HttpDoom - HTTP Attack surface analyser Validate large HTTP-based attack surfaces in a very fast and reliable way. Inspired by Aquatone. Installing You must have dotnet SDK at version 6+: $ dotnet pack -c Release -o nupkg $ dotnet tool install --global --add-source .\nupkg\ httpdoom.console...
CVE-2024-44625-Gogs-RCE-0.13.0
CVE-2024-44625 & Gogs-RCE-0.13.0 Validated against a 0.13.0-era Gogs behind a reverse proxy. Primitive: web editor symlink-follow to an ABSENT .git/hooks/pre-receive creates that file executable. Every subsequent push to the repo runs it. Usage: Reverse shell run listener first: nc -lvnp 4444...
CVE-2022-0155-PoC
CVE-2022-0155 Proof-of-Concept PoC This repository contains a demonstration of the CVE-2022-0155 vulnerability. The vulnerability was detected by ranjit-git and is described in detail here. The purpose of this PoC is to demonstrate that the vulnerability doesn't just apply to scenarios where...
Linux Distros Unpatched Vulnerability : CVE-2026-111756
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects...
follow-redirects: follow-redirects: Information disclosure via cross-domain redirects
A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect a redirection to a different domain, custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect...
follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects
A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...
follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering
A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containing special regular expression characters, the library fail...
follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering
A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containing special regular expression characters, the library fail...
follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects
A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...
follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering
A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containing special regular expression characters, the library fail...
follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects
A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...
UBUNTU-CVE-2026-111755
follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom...
CVE-2026-111755
follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom...
SUSE CVE-2026-111756
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...
ROOT-APP-NPM-CVE-2026-111755 CVE-2026-111755 in follow-redirects - Patched by Root
Root has patched CVE-2026-111755 in the follow-redirects package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-111756 CVE-2026-111756 in follow-redirects - Patched by Root
Root has patched CVE-2026-111756 in the follow-redirects package for Root:npm. Multiple fixed versions available...
Node.js follow-redirects Unauthorized Access
The vulnerability in Node.js’ follow-redirects module relates to the redirection of confidential user data without proper deletion procedures. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...