THREATIST.IORead the docs Cluster Observability Operator 1.0.0
Released 2025-02-17 · Red Hat rating Important · View on Red Hat →
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function.
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.