Every CVE Search/ Get API key

CVE-2023-30846

typed-rest-client vulnerable to potential leak of authentication data to 3rd parties

9.1 CriticalFix available

typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the Authorization header. The expected behavior is that the next request will NOT set the Authorization header. The problem was fixed in version 1.8.0. There are no known workarounds.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

2.22%Up 2.2 points since Apr 27, 2023
90%50%10%1%

What each source reports

CVE List Score used 9.1

typed-rest-client vulnerable to potential leak of authentication data to 3rd parties

typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the Authorization header. The expected behavior is that the next request will NOT set the Authorization header. The problem was fixed in version 1.8.0. There are no known workarounds.

Record
CVE-2023-30846
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-522
Updated
2026-11-02
EUVDEUVD-2023-1200 9.1

typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the Authorization header. The expected behavior is that the next request will NOT set the Authorization header. The problem was fixed in version 1.8.0. There are no known workarounds.

Record
EUVD-2023-1200
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-558p-m34m-vpmq 9.1

Potential leak of authentication data to 3rd parties

Impact

Users of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties.

The flow of the vulnerability is as follows:

  1. Send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler
  2. The target host may return a redirection (3xx), with a link to a second host.
  3. The next request will use the credentials to authenticate with the second host, by setting the Authorization header.

The expected behavior is that the next request will NOT set the Authorization header.

Patches

The problem was fixed on April 1st 2020.

Workarounds

There is no workaround.

References

This is similar to the following issues in nature:

  1. HTTP authentication leak in redirects - I used the same solution as CURL did.
  2. CVE-2018-1000007.
Record
GHSA-558p-m34m-vpmq
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-522
Updated
2026-11-02
NVD 9.1

typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the Authorization header. The expected behavior is that the next request will NOT set the Authorization header. The problem was fixed in version 1.8.0. There are no known workarounds.

Record
CVE-2023-30846
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
OSV 9.1

typed-rest-client vulnerable to potential leak of authentication data to 3rd parties

typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the Authorization header. The expected behavior is that the next request will NOT set the Authorization header. The problem was fixed in version 1.8.0. There are no known workarounds.

Record
CVE-2023-30846
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-522
Updated
2026-11-02
OSVGHSA-558p-m34m-vpmq 9.1

Potential leak of authentication data to 3rd parties

Impact

Users of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties.

The flow of the vulnerability is as follows:

  1. Send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler
  2. The target host may return a redirection (3xx), with a link to a second host.
  3. The next request will use the credentials to authenticate with the second host, by setting the Authorization header.

The expected behavior is that the next request will NOT set the Authorization header.

Patches

The problem was fixed on April 1st 2020.

Workarounds

There is no workaround.

References

This is similar to the following issues in nature:

  1. HTTP authentication leak in redirects - I used the same solution as CURL did.
  2. CVE-2018-1000007.
Record
GHSA-558p-m34m-vpmq
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-522
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
typed-rest-client
npm
 before 1.8.0
1.8.0

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30846 is a critical vulnerability (CVSS 9.1) in Microsoft Typed-rest-client, published April 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.22%, the 82nd percentile. Fixed in typed-rest-client 1.8.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open