Improper input validation in follow-redirects
Priority HIGH 65CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 15 fixed, 20 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00797 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial follow-redirects: 1.15.4follow-redirects (npm): 1.15.4Red Hat: 12 advisoriesRed Hat: 15 fixed, 20 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | follow-redirects | before 1.15.4 | 1.15.4 | Patch available | CNA |
| — | follow-redirects (npm) | before 1.15.4 | 1.15.4 | Patch available | GHSA-jchw-25xp-jwwc |
- follow-redirects Vendor— Affected before 1.15.4 Fixed in 1.15.4 Patch available CNA
- follow-redirects (npm) Vendor— Affected before 1.15.4 Fixed in 1.15.4 Patch available GHSA-jchw-25xp-jwwc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:follow-redirects:follow_redirects:*:*:*:*:*:node.js:*:* | before 1.15.4 | Vulnerable | follow-redirects |
- cpe:2.3:a:follow-redirects:follow_redirects:*:*:*:*:*:node.js:*:* Versions before 1.15.4 Vulnerable ·follow-redirects
Remediation
- Fix · CNA follow-redirects Fixed in 1.15.4
- Fix · GHSA-jchw-25xp-jwwc follow-redirects (npm) Fixed in 1.15.4 Advisory →
Red Hat 12 advisories
- RHSA-2025:1609 Released 2025-02-17 · Red Hat rating ImportantCluster Observability Operator 1.0.0
- Cluster Observability Operator 1.0.0 registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator
- RHSA-2024:3989 Released 2024-06-20 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-ui-rhel9, mta/mta-windup-addon-rhel9
- RHSA-2024:3316 Released 2024-05-23 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 7.0 for RHEL 9 mta/mta-analyzer-addon-rhel9, mta/mta-analyzer-lsp-rhel9, mta/mta-cli-rhel9 +3
Show 9 more Red Hat advisories
- RHSA-2024:3314 Released 2024-05-23 · Red Hat rating ImportantOpenShift Virtualization 4.15.2 Images security update
- CNV 4.15 for RHEL 9 container-native-virtualization/aaq-controller-rhel9, container-native-virtualization/aaq-operator-rhel9, container-native-virtualization/aaq-server-rhel9 +47
- RHSA-2024:1946 Released 2024-04-22 · Red Hat rating ModerateRed Hat OpenShift Service Mesh Containers for 2.5.1 security update
- RHOSSM 2.5 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +7
- RHSA-2024:1383 Released 2024-03-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
- RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +23
- RHSA-2024:1027 Released 2024-02-28 · Red Hat rating ModerateMigration Toolkit for Applications security update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-pathfinder-rhel9 +3
- RHSA-2023:7198 Released 2024-02-27 · Red Hat rating CriticalOpenShift Container Platform 4.15.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
- RHSA-2024:0998 Released 2024-02-27 · Red Hat rating LowRed Hat OpenShift distributed tracing 3.1.0 operator/operand containers
- Red Hat OpenShift distributed tracing 3.1 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +16
- RHSA-2024:0853 Released 2024-02-21 · Red Hat rating ModerateNetwork Observability 1.5.0 for OpenShift
- NETOBSERV 1.5 for RHEL 9 network-observability/network-observability-console-plugin-rhel9
- RHSA-2024:0720 Released 2024-02-07 · Red Hat rating ModerateMigration Toolkit for Runtimes security, bug fix and enhancement update
- MTR 1.2.4
- RHSA-2024:0271 Released 2024-01-17 · Red Hat rating ModerateLogging Subsystem 5.8.2 - Red Hat OpenShift security update
- RHOL 5.8 for RHEL 9 openshift-logging/logging-view-plugin-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 2 | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| 8Base-MTV-2.5 | Fixed | — |
| CNV 4.15 for RHEL 9 | Fixed | RHSA-2024:3314 |
| Cluster Observability Operator 1.0.0 | Fixed | RHSA-2025:1609 |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2024:1027, RHSA-2024:3989 |
| MTA 7.0 for RHEL 9 | Fixed | RHSA-2024:3316 |
| MTR 1.2.4 | Fixed | RHSA-2024:0720 |
| NETOBSERV 1.5 for RHEL 9 | Fixed | RHSA-2024:0853 |
| RHDH 1.1 for RHEL 9 | Fixed | — |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2024:1383 |
| RHOL 5.8 for RHEL 9 | Fixed | RHSA-2024:0271 |
| RHOSSM 2.5 for RHEL 8 | Fixed | RHSA-2024:1946 |
| Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 | Fixed | — |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2023:7198 |
| Red Hat OpenShift distributed tracing 3.1 | Fixed | RHSA-2024:0998 |
| multicluster engine for Kubernetes 2.4 for RHEL 8 | Fixed | — |
Not affected: 31 products
- 8Base-MTV-2.5
- CNV 4.15 for RHEL 9
- Cluster Observability Operator 1.0.0
- Logging Subsystem for Red Hat OpenShift
- MTA 6.2 for RHEL 8
- MTA 7.0 for RHEL 8
- MTA 7.0 for RHEL 9
- Migration Toolkit for Containers
- NETOBSERV 1.5 for RHEL 9
- Node HealthCheck Operator
- OpenShift Serverless
- RHDH 1.1 for RHEL 9
- RHODF 4.15 for RHEL 9
- RHOL 5.8 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
- Red Hat Ansible Automation Platform 1.2
- Red Hat Ansible Automation Platform 2
- Red Hat Discovery 1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Integration Camel K 1
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift GitOps
- Red Hat OpenShift distributed tracing 2
- Red Hat Openshift Data Foundation 4
- Red Hat Satellite 6
- Red Hat build of Apache Camel - HawtIO 4
- multicluster engine for Kubernetes 2.4 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26159
- 2026-10-03 Alias added: GHSA-jchw-25xp-jwwc
References
Other 5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM/
- https://github.com/follow-redirects/follow-redirects/commit/7a6567e16dfa9ad18a70bfe91784c28653fbf19d
- https://github.com/follow-redirects/follow-redirects
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM
- https://security.netapp.com/advisory/ntap-20241108-0002
Sources
- CVE-2023-26159 · CVE Program
- CVE-2023-26159 · NVD
- FIRST EPSS
- GHSA-jchw-25xp-jwwc · GitHub Advisory Database · CC BY 4.0
- CVE-2023-26159 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences