Read the docs
TI-2022-00097 Aliases CVE-2022-0155GHSA-74fj-2j2h-c42q

Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects

Priority LOW 34CWE-359Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 8 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-359.

Summary

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Why it matters now

EPSS 0.02608 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial follow-redirects/follow-redirects (follow-redirects): 1.14.7follow-redirects (npm): 1.14.7Red Hat: 11 advisoriesRed Hat: 8 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
follow-redirectsfollow-redirects/follow-redirectsbefore 1.14.71.14.7Patch availableCNA
—follow-redirects (npm)before 1.14.71.14.7Patch availableGHSA-74fj-2j2h-c42q
  • follow-redirects/follow-redirects Vendorfollow-redirects Affected before 1.14.7 Fixed in 1.14.7 Patch available CNA
  • follow-redirects (npm) Vendor— Affected before 1.14.7 Fixed in 1.14.7 Patch available GHSA-74fj-2j2h-c42q

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:follow-redirects_project:follow-redirects:*:*:*:*:*:node.js:*:*before 1.14.7VulnerableFollow-redirects Project
cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*before 1.0VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*1.0VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*1.0 sp1VulnerableSiemens
  • cpe:2.3:a:follow-redirects_project:follow-redirects:*:*:*:*:*:node.js:*:* Versions before 1.14.7 Vulnerable ·Follow-redirects Project
  • cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* Versions before 1.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* Versions 1.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* Versions 1.0 sp1 Vulnerable ·Siemens

Remediation

  • Fix · CNA follow-redirects/follow-redirects (follow-redirects) Fixed in 1.14.7
  • Fix · GHSA-74fj-2j2h-c42q follow-redirects (npm) Fixed in 1.14.7 Advisory →

Red Hat 11 advisories

  • RHSA-2025:22420 Released 2025-12-01 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.14 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.14 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-cli-rhel9, registry.redhat.io/odf4/mcg-core-rhel9 +15
  • RHSA-2025:22418 Released 2025-12-01 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.15 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2025:22416 Released 2025-12-01 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.16 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
Show 8 more Red Hat advisories
  • RHSA-2025:22415 Released 2025-12-01 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.17 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2025:21704 Released 2025-11-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2025:21378 Released 2025-11-13 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.19 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2025:21368 Released 2025-11-13 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.18 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2022:8502 Released 2022-11-16 · Red Hat rating Moderate
    RHV Manager (ovirt-engine) [ovirt-4.5.3] bug fix and security update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.5.3.2-1.el8ev, ovirt-engine-backend-4.5.3.2-1.el8ev, ovirt-engine-dbscripts-4.5.3.2-1.el8ev +22
  • RHSA-2022:1681 Released 2022-05-03 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
  • RHSA-2022:1476 Released 2022-04-21 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
  • RHSA-2022:0856 Released 2022-03-14 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.2.11 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/search-aggregator-rhel7 +1
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 1AffectedNo fix planned: Out of support scope
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2022:8502
Red Hat Openshift Data Foundation 4.14Fixed RHSA-2025:22420
Red Hat Openshift Data Foundation 4.15Fixed RHSA-2025:22418
Red Hat Openshift Data Foundation 4.16Fixed RHSA-2025:22416
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2025:22415
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2025:21368
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2025:21378
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2025:21704
Not affected: 8 products
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat Openshift Data Foundation 4.14
  • Red Hat Openshift Data Foundation 4.15
  • Red Hat Openshift Data Foundation 4.16
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0155
  2. 2026-10-03 Alias added: GHSA-74fj-2j2h-c42q

References

Exploit 1

Patch 2

Advisory 1

Other 1

  • TI-2026-76983 Credential headers leak across redirects in follow-redirects CVSS 4.0HIGH 8.2
  • TI-2026-76533 Regex escaping flaw in follow-redirects leaks credential headers CVSS 4.0HIGH 8.2
  • TI-2023-11383 Improper input validation in follow-redirects CVSS 3.1HIGH 7.3
  • TI-2024-19051 Proxy-Authorization header kept across hosts in follow-redirects CVSS 3.1MEDIUM 6.5
  • TI-2026-81522 Credential headers forwarded on redirects in follow-redirects CVSS 3.1MEDIUM 5.9
  • TI-2026-29551 follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets CVSS 4.0MEDIUM 6.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences