Improper Input Validation in follow-redirects
Summary
CVE-2023-26159: Follow Redirects improperly handles URLs in the url.parse() function. Affects follow-redirects versions < 1.15.4. Fixed in 1.15.4. How to fix ↓
Also tracked for
- node-follow-redirects · Debian:11
The same CVE-2023-26159 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The follow-redirects package is an npm module that provides a way to handle HTTP redirects in Node.js applications. It is commonly used to follow HTTP redirects and retrieve the final response. However, versions before 1.15.4 of the package are vulnerable to an Improper Input Validation issue.
Vulnerability Detail
The vulnerability in follow-redirects stems from the improper handling of URLs by the url.parse() function. When a new URL() throws an error, it can be manipulated to misinterpret the hostname. This weakness can be exploited by an attacker to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches. The vulnerability has a CVSSv3 score of 7.3, indicating a high severity.
How To Fix
Latest published version: 1.16.1 as of 22 Oct 2026
npm install follow-redirects@1.16.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.15.4
This is the first release that contains the fix.
npm install follow-redirects@1.15.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the latest version as soon as possible.
Conclusion
The follow-redirects package is vulnerable to an Improper Input Validation issue that can be exploited by attackers to redirect traffic to malicious sites. It is crucial to update the package to version 1.15.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for follow-redirects →
FAQ
follow-redirects is an npm module used to handle HTTP redirects in Node.js applications.
Versions before 1.15.4 of the follow-redirects package are affected.
This vulnerability can be exploited by an attacker to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
To fix this vulnerability, update the follow-redirects package to version 1.15.4 or later by running the command: npm install follow-redirects@latest
There is no known workaround for this vulnerability. It is recommended to update the package to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for follow-redirects.
