Read the docs
TI-2020-08895 Aliases CVE-2020-11021GHSA-9w6v-m7wp-jwg4

HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.

Why it matters now

EPSS 0.01781 78th percentileScored 2026-11-07
Fix Fixed http-client (actions): 1.0.8@actions/http-client (npm): 1.0.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
actionshttp-clientbefore 1.0.81.0.8Patch availableCNA
—@actions/http-client (npm)before 1.0.81.0.8Patch availableGHSA-9w6v-m7wp-jwg4
  • http-client Vendoractions Affected before 1.0.8 Fixed in 1.0.8 Patch available CNA
  • @actions/http-client (npm) Vendor— Affected before 1.0.8 Fixed in 1.0.8 Patch available GHSA-9w6v-m7wp-jwg4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:http-client_project:http-client:*:*:*:*:*:node.js:*:*before 1.0.8VulnerableHttp-client Project
  • cpe:2.3:a:http-client_project:http-client:*:*:*:*:*:node.js:*:* Versions before 1.0.8 Vulnerable ·Http-client Project

Remediation

  • Fix · CNA http-client (actions) Fixed in 1.0.8
  • Fix · GHSA-9w6v-m7wp-jwg4 @actions/http-client (npm) Fixed in 1.0.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11021
  2. 2026-10-03 Alias added: GHSA-9w6v-m7wp-jwg4

References

Patch 2

Advisory 2

Other 1

  • TI-2025-05316 actions toolkit glob internal-pattern.ts globEscape redos CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences