Follow Redirects improperly handles URLs in the url.parse() function
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | follow-redirects | < 1.15.4 | 1.15.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-26159
- https://github.com/follow-redirects/follow-redirects/issues/235
- https://github.com/follow-redirects/follow-redirects/pull/236
- https://github.com/follow-redirects/follow-redirects/commit/7a6567e16dfa9ad18a70bfe91784c28653fbf19d
- https://github.com/follow-redirects/follow-redirects
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM
- https://security.netapp.com/advisory/ntap-20241108-0002
- https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-20, CWE-601- Platform
- npm
- Package
follow-redirects- Disclosed
- 02.01.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-jchw-25xp-jwwc - CC BY 4.0
Vulnerability history: follow-redirects
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 01.2022 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 4
Disclosures per year
- 2022: 2
- 2023: 0
- 2024: 2
- 2025: 0
- 2026: 1
-
Follow Redirects improperly handles URLs in the url.parse() function this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.