Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Priority LOW 29CWE-212Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 11 fixed, 24 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
Why it matters now
EPSS 0.01337 71st percentileScored 2026-11-07
Fix Partial follow-redirects/follow-redirects (follow-redirects): 1.14.8follow-redirects (npm): 1.14.8Red Hat: 14 advisoriesRed Hat: 11 fixed, 24 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| follow-redirects | follow-redirects/follow-redirects | before 1.14.8 | 1.14.8 | Patch available | CNA |
| — | follow-redirects (npm) | before 1.14.8 | 1.14.8 | Patch available | GHSA-pw2r-vq6v-hr8c |
- follow-redirects/follow-redirects Vendorfollow-redirects Affected before 1.14.8 Fixed in 1.14.8 Patch available CNA
- follow-redirects (npm) Vendor— Affected before 1.14.8 Fixed in 1.14.8 Patch available GHSA-pw2r-vq6v-hr8c
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:follow-redirects_project:follow-redirects:*:*:*:*:*:node.js:*:* | before 1.14.8 | Vulnerable | Follow-redirects Project |
- cpe:2.3:a:follow-redirects_project:follow-redirects:*:*:*:*:*:node.js:*:* Versions before 1.14.8 Vulnerable ·Follow-redirects Project
Remediation
- Fix · CNA follow-redirects/follow-redirects (follow-redirects) Fixed in 1.14.8
- Fix · GHSA-pw2r-vq6v-hr8c follow-redirects (npm) Fixed in 1.14.8 Advisory →
Red Hat 14 advisories
- RHSA-2025:22420 Released 2025-12-01 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.14 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.14 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-cli-rhel9, registry.redhat.io/odf4/mcg-core-rhel9 +15
- RHSA-2025:22418 Released 2025-12-01 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.15 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.15 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
- RHSA-2025:22416 Released 2025-12-01 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.16 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
Show 11 more Red Hat advisories
- RHSA-2025:22415 Released 2025-12-01 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.17 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2025:21704 Released 2025-11-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
- RHSA-2025:21378 Released 2025-11-13 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.19 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2025:21368 Released 2025-11-13 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.18 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2022:7055 Released 2022-10-19 · Red Hat rating ModerateRHOSDT 2.6.0 operator/operand containers Security Update
- Red Hat OpenShift distributed tracing 2.6 rhosdt/opentelemetry-collector-rhel8, rhosdt/opentelemetry-rhel8-operator
- RHSA-2022:6835 Released 2022-10-06 · Red Hat rating ImportantService Registry (container images) release and security update [2.3.0.GA]
- RHINT Service Registry 2.3.0 GA
- RHSA-2022:6156 Released 2022-08-24 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
- RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
- RHSA-2022:5483 Released 2022-07-01 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.2 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-ui-rhel8
- RHSA-2022:1739 Released 2022-05-05 · Red Hat rating ModerateRed Hat OpenShift Service Mesh 2.1.2.1 containers security update
- OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8
- RHSA-2022:1681 Released 2022-05-03 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
- RHSA-2022:1476 Released 2022-04-21 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.4.3 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| .NET Core 3.1 on Red Hat Enterprise Linux | Affected | No fix planned: Out of support scope |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Data Virtualisation Operator | Affected | No fix planned: Out of support scope |
| Red Hat Integration Service Registry | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:5483 |
| OpenShift Service Mesh 2.1 | Fixed | RHSA-2022:1739 |
| RHINT Service Registry 2.3.0 GA | Fixed | RHSA-2022:6835 |
| RHODF 4.11 for RHEL 8 | Fixed | RHSA-2022:6156 |
| Red Hat Openshift Data Foundation 4.14 | Fixed | RHSA-2025:22420 |
| Red Hat Openshift Data Foundation 4.15 | Fixed | RHSA-2025:22418 |
| Red Hat Openshift Data Foundation 4.16 | Fixed | RHSA-2025:22416 |
| Red Hat Openshift Data Foundation 4.17 | Fixed | RHSA-2025:22415 |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2025:21368 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2025:21378 |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2025:21704 |
Not affected: 18 products
- 8Base-RHMTC-1.7
- OpenShift Service Mesh 2.1
- RHODF 4.11 for RHEL 8
- Red Hat A-MQ Online
- Red Hat Ansible Automation Platform 1.2
- Red Hat Ansible Automation Platform 2
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift GitOps
- Red Hat Openshift Data Foundation 4.14
- Red Hat Openshift Data Foundation 4.15
- Red Hat Openshift Data Foundation 4.16
- Red Hat Openshift Data Foundation 4.17
- Red Hat Openshift Data Foundation 4.18
- Red Hat Openshift Data Foundation 4.19
- Red Hat Openshift Data Foundation 4.20
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0536
- 2026-10-03 Alias added: GHSA-pw2r-vq6v-hr8c
References
More follow-redirects vulnerabilities
- TI-2026-76983 Credential headers leak across redirects in follow-redirects CVSS 4.0HIGH 8.2
- TI-2026-76533 Regex escaping flaw in follow-redirects leaks credential headers CVSS 4.0HIGH 8.2
- TI-2023-11383 Improper input validation in follow-redirects CVSS 3.1HIGH 7.3
- TI-2024-19051 Proxy-Authorization header kept across hosts in follow-redirects CVSS 3.1MEDIUM 6.5
- TI-2026-81522 Credential headers forwarded on redirects in follow-redirects CVSS 3.1MEDIUM 5.9
- TI-2022-00097 Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects CVSS 3.1MEDIUM 6.5
Sources
- CVE-2022-0536 · CVE Program
- CVE-2022-0536 · NVD
- FIRST EPSS
- GHSA-pw2r-vq6v-hr8c · GitHub Advisory Database · CC BY 4.0
- CVE-2022-0536 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences