{"id":"CVE-2023-26159","aliases":["AZL-32314","AZL-38299","AZL-43636","AZL-45348","CLSA-2026-1774830259","CLSA-2026-1776818197","CLSA-2026-1782176274","CLSA-2026-1782262692","CLSA-2026-1782262693","CLSA-2026-1792074325","DEBIAN-CVE-2023-26159","EUVD-2024-0377","GHSA-jchw-25xp-jwwc","GHSA-r4q5-vmmm-2653","UBUNTU-CVE-2023-26159","USN-8217-1"],"status":"published","title":"Follow Redirects improperly handles URLs in the url.parse() function","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00797,"percentile":0.56932,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-601"],"published":"2024-01-02T05:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"follow-redirects","fixed_in":["1.15.4"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-8"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-tensorboard","fixed_in":["2.16.2-1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"follow-redirects","fixed_in":["1.0.0-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-follow-redirects","fixed_in":["1.15.6+~1.14.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-follow-redirects","fixed_in":["1.15.6+~1.14.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","fixed_in":["1.2.4-1ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","fixed_in":["1.2.4-1ubuntu0.20.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-follow-redirects","fixed_in":["1.14.9+~1.14.1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.3-tuxcare.0"},{"fixed":"0.0.3-tuxcare.1"}]}],"versions":["0.0.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-tuxcare.0"},{"fixed":"1.0.0-tuxcare.2"}]}],"versions":["1.0.0","1.0.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.10-tuxcare.0"},{"fixed":"1.5.10-tuxcare.1"}]}],"versions":["1.5.10"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.3-tuxcare.0"},{"fixed":"1.15.3-tuxcare.1"}]}],"versions":["1.15.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.2-tuxcare.0"},{"fixed":"1.15.2-tuxcare.1"}]}],"versions":["1.15.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.6-tuxcare.0"},{"fixed":"1.2.6-tuxcare.2"}]}],"versions":["1.2.6","1.2.6-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.11+~1.14.4-1","1.15.11+~1.14.4-2","1.15.2+~1.14.1-1","1.15.3+~1.14.2-1","1.15.6+~1.14.4-1","1.15.6+~1.14.4-2","1.15.9+~1.14.4-1","1.16.0+~1.14.4-1","1.16.0+~1.14.4-2","1.16.1+~1.14.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.6+~1.14.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.6+~1.14.4-1"}]}]},{"source":"osv","ecosystem":"npm","package":"follow-redirects","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.18.04.1~esm1"}]}],"versions":["1.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.9+~1.14.1-1ubuntu0.1~esm1"}]}],"versions":["1.13.1-1","1.14.5-1","1.14.7+~1.13.1-1","1.14.8+~1.14.0-1","1.14.9+~1.14.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.18.04.1~esm1"}]}],"versions":["1.2.4-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.2.4-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.9+~1.14.1-1ubuntu0.1~esm1"}]}],"versions":["1.13.1-1","1.14.5-1","1.14.7+~1.13.1-1","1.14.8+~1.14.0-1","1.14.9+~1.14.1-1"],"bundled":4}],"products":[{"vendor":"follow-redirects","product":"follow-redirects"},{"vendor":"follow-redirects","product":"follow_redirects"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://github.com/follow-redirects/follow-redirects/issues/235","tags":["x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://github.com/follow-redirects/follow-redirects/pull/236","tags":["x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM/","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26159","tags":["web","advisory"]},{"url":"https://github.com/follow-redirects/follow-redirects/commit/7a6567e16dfa9ad18a70bfe91784c28653fbf19d","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jchw-25xp-jwwc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26159.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-26159","tags":["advisory"]},{"url":"https://github.com/follow-redirects/follow-redirects","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-26159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26159","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8217-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-28849","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-26159","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T05:00:00.659Z","modified":"2025-11-03T21:47:30.161Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-601"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2024-0377","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T05:00:00Z","modified":"2025-11-03T21:47:30Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","level":"high"}],"updated_at":"2026-11-02T19:49:31.25882Z"}],"ghsa":[{"id":"GHSA-jchw-25xp-jwwc","title":"Follow Redirects improperly handles URLs in the url.parse() function","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T06:30:30Z","modified":"2025-11-04T16:48:09Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-601"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2023-26159","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T05:15:08.63Z","modified":"2026-06-17T05:42:48.68Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-601"],"updated_at":"2026-11-02T14:08:59.830468Z"}],"osv":[{"id":"AZL-32314","title":"CVE-2023-26159 affecting package reaper for versions less than 3.1.1-8","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T05:15:08Z","modified":"2026-04-21T04:26:46.380982Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-38299","title":"CVE-2023-26159 affecting package python-tensorboard for versions less than 2.16.2-1","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T05:15:08Z","modified":"2026-04-21T04:54:09.541075Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-43636","title":"CVE-2023-26159 affecting package js-jquery 3.5.0-4","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T05:15:08Z","modified":"2026-04-21T04:31:05.227166Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-45348","title":"CVE-2023-26159 affecting package js-jquery 3.5.0-4","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T05:15:08Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2023-26159","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T05:00:00.659Z","modified":"2026-10-28T02:30:51.91427559Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"DEBIAN-CVE-2023-26159","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T05:15:08.63Z","modified":"2026-10-26T18:02:10.757944417Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-jchw-25xp-jwwc","title":"Follow Redirects improperly handles URLs in the url.parse() function","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T06:30:30Z","modified":"2026-09-10T03:50:04.950374112Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-601"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"UBUNTU-CVE-2023-26159","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","status":"published","published":"2024-01-02T05:15:00Z","modified":"2026-04-29T10:24:40.10844Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"CLSA-2026-1774830259","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 0.0.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.690741988Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776818197","title":"TuxCare security update for follow-redirects (1 CVE)","description":"TuxCare rebuilt follow-redirects to address 1 CVE. Fixed in 1.0.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:46.409360176Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1782176274","title":"TuxCare security update for follow-redirects (5 CVEs)","description":"TuxCare rebuilt follow-redirects to address 5 CVEs. Fixed in 1.5.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.323495469Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262692","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.15.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.993398018Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262693","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.15.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.993368244Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1792074325","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.2.6-tuxcare.2.","status":"published","published":"2026-10-15T14:25:25Z","modified":"2026-10-15T19:00:11.997374602Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"USN-8217-1","title":"node-follow-redirects vulnerabilities","description":"It was discovered that follow-redirects did not properly protect sensitive\nuser information during redirects. An attacker could possibly use this\nissue to expose sensitive information. This issue only affected Ubuntu\n18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0155)\n\nIt was discovered that follow-redirects did not properly remove sensitive\ninformation before storage or transfer. An attacker could possibly use this\nissue to expose sensitive information. This issue only affected Ubuntu\n18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0536)\n\nIt was discovered that follow-redirects did not properly validate URLs when\nhandling certain inputs. An attacker could possibly use this issue to\nredirect users to a malicious site, resulting in information disclosure or\nphishing attacks. (CVE-2023-26159)\n\nIt was discovered that follow-redirects did not properly clear proxy\nauthentication headers during cross-domain redirects. An attacker could\npossibly use this issue to cause exposure of sensitive credentials.\n(CVE-2024-28849)","status":"published","published":"2026-04-28T13:57:04Z","modified":"2026-04-29T10:45:17.150695519Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}