CVE-2022-0155: Exposure of sensitive information in follow-redirects
Summary
Your scan reports follow-redirects 1.13.0. Fixed in 1.14.7.
CVE-2022-0155: Exposure of sensitive information in follow-redirects. Affects follow-redirects versions < 1.14.7. Fixed in 1.14.7. How to fix ↓
Also tracked for
- node-follow-redirects · Debian:11
The same CVE-2022-0155 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Background
The follow-redirects package is an npm module used for handling HTTP redirects. It provides a simple way to follow HTTP redirects automatically. The package is widely used in various applications and frameworks.
Vulnerability Detail
The follow-redirects package is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. This vulnerability allows an attacker to access sensitive information during the process of following HTTP redirects. The vulnerability has a CVSS score of 8.0, indicating a high severity level. The issue was identified on January 12, 2022, and has been reviewed by GitHub. The CWE ID associated with this vulnerability is CWE-359.
How To Fix
Latest published version: 1.16.1 as of 22 Oct 2026
npm install follow-redirects@1.16.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.14.7
This is the first release that contains the fix.
npm install follow-redirects@1.14.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update the package to the fixed version as soon as possible.
Conclusion
The follow-redirects package is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. It is crucial to update the package to version 1.14.7 or higher to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for follow-redirects →
FAQ
This vulnerability allows an unauthorized actor to access sensitive information during HTTP redirects, potentially leading to the exposure of private personal information.
Versions 0.0.1 to 1.14.6 of the follow-redirects package are affected by this vulnerability.
There is no known exploit available for this vulnerability at the moment.
The recommended mitigation is to update the follow-redirects package to version 1.14.7 or higher.
You can find more information about this vulnerability in the GitHub Advisory Database.
Related vulnerabilities
Recent vulnerabilities recorded for follow-redirects.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.