{"id":"CVE-2022-0536","aliases":["AZL-45156","CLSA-2026-1774830254","CLSA-2026-1774830259","CLSA-2026-1776731782","CLSA-2026-1782176274","CLSA-2026-1792074325","DEBIAN-CVE-2022-0536","EUVD-2022-1136","GHSA-pw2r-vq6v-hr8c","GHSA-r4q5-vmmm-2653","UBUNTU-CVE-2022-0536","USN-8217-1"],"status":"published","title":"Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects","description":"Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.","severity":{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01337,"percentile":0.71481,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-212"],"published":"2022-02-09T10:45:10Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"follow-redirects","fixed_in":["1.14.8"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"follow-redirects","fixed_in":["1.15.11-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-follow-redirects","fixed_in":["1.14.8+~1.14.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-follow-redirects","fixed_in":["1.14.8+~1.14.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-follow-redirects","fixed_in":["1.14.8+~1.14.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","fixed_in":["1.2.4-1ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","fixed_in":["1.2.4-1ubuntu0.20.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.11-tuxcare.0"},{"fixed":"1.15.11-tuxcare.1"}]}],"versions":["1.15.11"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.3-tuxcare.0"},{"fixed":"0.0.3-tuxcare.1"}]}],"versions":["0.0.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-tuxcare.0"},{"fixed":"1.0.0-tuxcare.1"}]}],"versions":["1.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.10-tuxcare.0"},{"fixed":"1.5.10-tuxcare.1"}]}],"versions":["1.5.10"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.6-tuxcare.0"},{"fixed":"1.2.6-tuxcare.2"}]}],"versions":["1.2.6","1.2.6-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.8+~1.14.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.8+~1.14.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.8+~1.14.0-1"}]}]},{"source":"osv","ecosystem":"npm","package":"follow-redirects","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.14.8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.18.04.1~esm1"}]}],"versions":["1.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.18.04.1~esm1"}]}],"versions":["1.2.4-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.2.4-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.9+~1.14.1-1ubuntu0.1~esm1"}]}],"versions":["1.13.1-1","1.14.5-1","1.14.7+~1.13.1-1","1.14.8+~1.14.0-1","1.14.9+~1.14.1-1"],"bundled":4}],"products":[{"vendor":"follow-redirects","product":"follow-redirects/follow-redirects"},{"vendor":"follow-redirects_project","product":"follow-redirects"}],"references":[{"url":"https://huntr.dev/bounties/7cf2bf90-52da-4d59-8028-a73b132de0db","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web","report"]},{"url":"https://github.com/follow-redirects/follow-redirects/commit/62e546a99c07c3ee5e4e0718c84a6ca127c5c445","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0536","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pw2r-vq6v-hr8c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0536.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0536","tags":["advisory"]},{"url":"https://github.com/follow-redirects/follow-redirects","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-0536","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0536","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8217-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-26159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-28849","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-0536","title":"Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects","description":"Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.","status":"published","published":"2022-02-09T10:45:10Z","modified":"2024-08-02T23:32:46.161Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-212"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-1136","description":"Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.","status":"published","published":"2022-02-09T10:45:10Z","modified":"2024-08-02T23:32:46Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T03:26:04.946671Z"}],"ghsa":[{"id":"GHSA-pw2r-vq6v-hr8c","title":"Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects","description":"Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.","status":"published","published":"2022-02-10T00:00:31Z","modified":"2023-07-21T19:16:17Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T14:36:57.310051Z"}],"nvd":[{"id":"CVE-2022-0536","description":"Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.","status":"published","published":"2022-02-09T11:15:08.647Z","modified":"2026-06-17T04:20:47.77Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-212"],"updated_at":"2026-11-02T14:07:11.52734Z"}],"osv":[{"id":"AZL-45156","title":"CVE-2022-0536 affecting package js-jquery 3.5.0-4","description":"Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.","status":"published","published":"2022-02-09T11:15:08Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2022-0536","title":"Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects","description":"Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.","status":"published","published":"2022-02-09T10:45:10Z","modified":"2026-10-28T02:30:36.783339105Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-212"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DEBIAN-CVE-2022-0536","description":"Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.","status":"published","published":"2022-02-09T11:15:08.647Z","modified":"2026-11-03T08:00:23.467774392Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"GHSA-pw2r-vq6v-hr8c","title":"Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects","description":"Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.","status":"published","published":"2022-02-10T00:00:31Z","modified":"2026-09-10T03:49:12.815908091Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"UBUNTU-CVE-2022-0536","description":"Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.","status":"published","published":"2022-02-09T11:15:00Z","modified":"2026-04-29T10:01:08.87643Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"CLSA-2026-1774830254","title":"TuxCare security update for follow-redirects (1 CVE)","description":"TuxCare rebuilt follow-redirects to address 1 CVE. Fixed in 1.15.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.52409444Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774830259","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 0.0.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.690741988Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776731782","title":"TuxCare security update for follow-redirects (2 CVEs)","description":"TuxCare rebuilt follow-redirects to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:34.38219434Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1782176274","title":"TuxCare security update for follow-redirects (5 CVEs)","description":"TuxCare rebuilt follow-redirects to address 5 CVEs. Fixed in 1.5.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.323495469Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1792074325","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.2.6-tuxcare.2.","status":"published","published":"2026-10-15T14:25:25Z","modified":"2026-10-15T19:00:11.997374602Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"USN-8217-1","title":"node-follow-redirects vulnerabilities","description":"It was discovered that follow-redirects did not properly protect sensitive\nuser information during redirects. An attacker could possibly use this\nissue to expose sensitive information. This issue only affected Ubuntu\n18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0155)\n\nIt was discovered that follow-redirects did not properly remove sensitive\ninformation before storage or transfer. An attacker could possibly use this\nissue to expose sensitive information. This issue only affected Ubuntu\n18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0536)\n\nIt was discovered that follow-redirects did not properly validate URLs when\nhandling certain inputs. An attacker could possibly use this issue to\nredirect users to a malicious site, resulting in information disclosure or\nphishing attacks. (CVE-2023-26159)\n\nIt was discovered that follow-redirects did not properly clear proxy\nauthentication headers during cross-domain redirects. An attacker could\npossibly use this issue to cause exposure of sensitive credentials.\n(CVE-2024-28849)","status":"published","published":"2026-04-28T13:57:04Z","modified":"2026-04-29T10:45:17.150695519Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}