CVE-2022-0536
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
- Record
CVE-2022-0536- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-212
- Updated
- 2026-11-02
EUVDEUVD-2022-1136
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
- Record
EUVD-2022-1136- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pw2r-vq6v-hr8c
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
- Record
GHSA-pw2r-vq6v-hr8c- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-212
- Updated
- 2026-11-02
NVD
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
- Record
CVE-2022-0536- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-212
- Updated
- 2026-11-02
OSVAZL-45156
CVE-2022-0536 affecting package js-jquery 3.5.0-4
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
- Record
AZL-45156- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-05
OSV
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
- Record
CVE-2022-0536- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-212
- Updated
- 2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2022-0536
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
- Record
DEBIAN-CVE-2022-0536- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSVGHSA-pw2r-vq6v-hr8c
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
- Record
GHSA-pw2r-vq6v-hr8c- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-212
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-0536
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
- Record
UBUNTU-CVE-2022-0536- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1774830254 No score
TuxCare security update for follow-redirects (1 CVE)
TuxCare rebuilt follow-redirects to address 1 CVE. Fixed in 1.15.11-tuxcare.1.
- Record
CLSA-2026-1774830254- Updated
- 2026-11-02
OSVCLSA-2026-1774830259 No score
TuxCare security update for follow-redirects (4 CVEs)
TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 0.0.3-tuxcare.1.
- Record
CLSA-2026-1774830259- Updated
- 2026-11-02
OSVCLSA-2026-1776731782 No score
TuxCare security update for follow-redirects (2 CVEs)
TuxCare rebuilt follow-redirects to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.
- Record
CLSA-2026-1776731782- Updated
- 2026-11-02
OSVCLSA-2026-1782176274 No score
TuxCare security update for follow-redirects (5 CVEs)
TuxCare rebuilt follow-redirects to address 5 CVEs. Fixed in 1.5.10-tuxcare.1.
- Record
CLSA-2026-1782176274- Updated
- 2026-11-02
OSVCLSA-2026-1792074325 No score
TuxCare security update for follow-redirects (4 CVEs)
TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.2.6-tuxcare.2.
- Record
CLSA-2026-1792074325- Updated
- 2026-11-02
OSVUSN-8217-1 No score
node-follow-redirects vulnerabilities
It was discovered that follow-redirects did not properly protect sensitive user information during redirects. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0155)
It was discovered that follow-redirects did not properly remove sensitive information before storage or transfer. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0536)
It was discovered that follow-redirects did not properly validate URLs when handling certain inputs. An attacker could possibly use this issue to redirect users to a malicious site, resulting in information disclosure or phishing attacks. (CVE-2023-26159)
It was discovered that follow-redirects did not properly clear proxy authentication headers during cross-domain redirects. An attacker could possibly use this issue to cause exposure of sensitive credentials. (CVE-2024-28849)
- Record
USN-8217-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
follow-redirectsnpm |
before 1.14.8 | 1.14.8 |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
follow-redirectsTuxCare:npm |
1.15.11-tuxcare.0 up to 1.15.11-tuxcare.1, plus listed versions 1.15.11 |
1.15.11-tuxcare.1 |
follow-redirectsTuxCare:npm From an advisory covering 4 CVEs |
0.0.3-tuxcare.0 up to 0.0.3-tuxcare.1, plus listed versions 0.0.3 |
0.0.3-tuxcare.1 |
follow-redirectsTuxCare:npm From an advisory covering 2 CVEs |
1.0.0-tuxcare.0 up to 1.0.0-tuxcare.1, plus listed versions 1.0.0 |
1.0.0-tuxcare.1 |
follow-redirectsTuxCare:npm From an advisory covering 4 CVEs |
1.5.10-tuxcare.0 up to 1.5.10-tuxcare.1, plus listed versions 1.5.10 |
1.5.10-tuxcare.1 |
follow-redirectsTuxCare:npm From an advisory covering 4 CVEs |
1.2.6-tuxcare.0 up to 1.2.6-tuxcare.2, plus listed versions 1.2.61.2.6-tuxcare.1 |
1.2.6-tuxcare.2 |
node-follow-redirectsDebian:12 |
before 1.14.8+~1.14.0-1 | 1.14.8+~1.14.0-1 |
node-follow-redirectsDebian:13 |
before 1.14.8+~1.14.0-1 | 1.14.8+~1.14.0-1 |
node-follow-redirectsDebian:14 |
before 1.14.8+~1.14.0-1 | 1.14.8+~1.14.0-1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
node-follow-redirectsUbuntu:Pro:18.04:LTS |
before 1.2.4-1ubuntu0.18.04.1~esm1, plus listed versions 1.2.4-1 |
1.2.4-1ubuntu0.18.04.1~esm1 |
node-follow-redirectsUbuntu:Pro:20.04:LTS |
before 1.2.4-1ubuntu0.20.04.1~esm1, plus listed versions 1.2.4-1 |
1.2.4-1ubuntu0.20.04.1~esm1 |
node-follow-redirectsUbuntu:Pro:18.04:LTS From an advisory covering 4 CVEs |
before 1.2.4-1ubuntu0.18.04.1~esm1, plus listed versions 1.2.4-1 |
1.2.4-1ubuntu0.18.04.1~esm1 |
node-follow-redirectsUbuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 1.2.4-1ubuntu0.20.04.1~esm1, plus listed versions 1.2.4-1 |
1.2.4-1ubuntu0.20.04.1~esm1 |
node-follow-redirectsUbuntu:Pro:22.04:LTS From an advisory covering 4 CVEs |
before 1.14.9+~1.14.1-1ubuntu0.1~esm1, plus listed versions 1.13.1-11.14.5-11.14.7+~1.13.1-11.14.8+~1.14.0-11.14.9+~1.14.1-1 |
1.14.9+~1.14.1-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0536 is a low vulnerability (CVSS 2.6) in Follow-redirects Follow-redirects/follow-redirects, published February 9, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. Fixed in follow-redirects 1.14.8.
References
huntr.dev/bounties/7cf2bf90-52da-4d59-8028-a73b132de0db
github.com/follow-redirects/follow-redirects/commit/62e546a99c07c3ee5e4e0718c84a6ca127c5c445
nvd.nist.gov/vuln/detail/CVE-2022-0536
security-tracker.debian.org/tracker/CVE-2022-0536