Към съдържанието
Търсене

CVE-2026-40895: follow-redirects, изтичане на данни

7.5

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

Засегнати продукти

  • follow-redirects follow-redirects: < 1.16.0
  • Red Hat: още 81 продукта, добавени от Red Hat

    Cryostat 4 on RHEL 9, Cluster Observability Operator 1.5.0, multicluster engine for Kubernetes 2.1, multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.6, multicluster engine for Kubernetes 2.8, multicluster engine for Kubernetes 2.9, Network Observability (NETOBSERV) 1.11.0, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat Advanced Cluster Management for Kubernetes 2.16, Red Hat Advanced Cluster Security 4.9, Red Hat Advanced Cluster Security for Kubernetes 4.10, Red Hat Ansible Automation Platform 2.5, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Discovery 2, Red Hat Migration Toolkit 1.8, Red Hat Migration Toolkit for Applications 8.1, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4.22, Red Hat OpenShift Dev Spaces 3.28, Red Hat OpenShift Service Mesh 2.6, Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift Service Mesh 3.1, Red Hat OpenShift Service Mesh 3.2, Red Hat OpenShift Service Mesh 3.3, Red Hat Quay 3.10, Red Hat Quay 3.12, Red Hat Quay 3.14, Red Hat Quay 3.15, Red Hat Quay 3.16, Red Hat Quay 3.17, Red Hat Quay 3.9, Cryostat 4, Gatekeeper 3, Migration Toolkit for Applications 8, Migration Toolkit for Virtualization, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, OpenShift Service Mesh 3, Red Hat 3scale API Management Platform 2, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, Red Hat Build of Podman Desktop, Red Hat Build of Podman Desktop - Tech Preview, Red Hat Ceph Storage 9, Red Hat Connectivity Link 1, Red Hat Data Grid 8, Red Hat Developer Hub, Red Hat Edge Manager 1, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Fuse 7, Red Hat Hardened Images, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4, Red Hat OpenShift distributed tracing 3, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Red Hat Process Automation 7, Red Hat Satellite 6, Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer, Self-service automation portal 2, streams for Apache Kafka 2, streams for Apache Kafka 3

Вид слабост

История

  • 21 април 2026 Публикувано

Други уязвимости в follow-redirects follow-redirects

Първоизточници

CVE-2026-40895: follow-redirects, изтичане на данни | freedomonline.bg