Skip to content
Fencer Vulns
low 2.6

CVE-2022-0536 json

Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects

published 2022-02-09 4 y ago modified 2026-09-10 1 mo ago also GHSA-pw2r-vq6v-hr8c , EUVD-2022-1136

cvss
2.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

Patch / fix

  • npm follow-redirects 1.14.8
  • follow-redirects follow-redirects/follow-redirects 1.14.8
  • node-follow-redirects Debian 14, Debian 13, Debian 12 1.14.8+~1.14.0-1

debian advisories DEBIAN-CVE-2022-0536

  • node-follow-redirects Ubuntu Pro 18.04 LTS 1.2.4-1ubuntu0.18.04.1~esm1
  • node-follow-redirects Ubuntu Pro 20.04 LTS 1.2.4-1ubuntu0.20.04.1~esm1

ubuntu advisories UBUNTU-CVE-2022-0536

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0536 updated cvss 5.9

follow-redirects: Exposure of Sensitive Information via Authorization Header leak

  • Red Hat .NET Core 3.1 on Red Hat Enterprise Linux rh-dotnet31-dotnet, rh-dotnet31-dotnet-host, rh-dotnet31-dotnet-sdk-3.1, rh-dotnet31-dotnet-hostfxr-3.1, rh-dotnet31-dotnet-runtime-3.1, rh-dotnet31-dotnet-templates-3.1, +6 more
    affected: no fix planned “Out of support scope”
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8 Red Hat OpenShift Developer Tools and Services odo
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2.0 kiali, servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, openshift4/ose-console, rhacm2/search-ui-rhel8, rhacm2/mcm-topology-rhel8, rhacm2/console-header-rhel8, rhtas/rekor-search-ui-rhel9, +1 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator
    affected: no fix available
  • Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Decision Manager 7 follow-redirects
    affected: no fix available “Fix deferred”
show 22 more
  • Red Hat Enterprise Linux 8 dotnet, dotnet3.1, dotnet5.0, dotnet-host, dotnet-sdk-3.1, dotnet-sdk-5.0, +17 more
    affected: no fix planned “Will not fix”
  • Red Hat Fuse 7 follow-redirects Red Hat Integration Camel K 1 follow-redirects Red Hat Integration Camel Quarkus 1 follow-redirects
    affected: no fix available “Fix deferred”
  • Red Hat Integration Data Virtualisation Operator follow-redirects Red Hat Integration Service Registry follow-redirects Red Hat JBoss Data Grid 7 follow-redirects
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-grafana, openshift4/ose-thanos-rhel9, openshift4/ose-prometheus-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8, devspaces-theia-rhel8-container Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-query-rhel8, rhosdt/jaeger-ingester-rhel8, rhosdt/jaeger-collector-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-es-rollover-rhel8, +1 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Process Automation 7 follow-redirects
    affected: no fix available “Fix deferred”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Single Sign-On 7 follow-redirects
    affected: no fix available “Fix deferred”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-ui-rhel8
    under investigation
  • Red Hat OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8 1.36.9-1
    fixed: vendor fix RHSA-2022:1739
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.2-9
    fixed: vendor fix RHSA-2022:5483
  • Red Hat Openshift Data Foundation 4.14 odf4 v4.14-1764178221, odf4 v4.14-1764178222, odf4 v4.14-1764178236, odf4 v4.14-1764178261, odf4 v4.14-1764178273, odf4 v4.14-1764178319, +11 more
    fixed: vendor fix RHSA-2025:22420
  • Red Hat Openshift Data Foundation 4.15 odf4 v4.15-1764176261, odf4 v4.15-1764176342, odf4 v4.15-1764176372, odf4 v4.15-1764176485, odf4 v4.15-1764176675, odf4 v4.15-1764176690, +11 more
    fixed: vendor fix RHSA-2025:22418
  • Red Hat Openshift Data Foundation 4.16 odf4 v4.16-1764168955, odf4 v4.16-1764169118, odf4 v4.16-1764169242, odf4 v4.16-1764169347, odf4 v4.16-1764169457, odf4 v4.16-1764169464, +12 more
    fixed: vendor fix RHSA-2025:22416
  • Red Hat Openshift Data Foundation 4.17 odf4 v4.17-1764167795, odf4 v4.17-1764167826, odf4 v4.17-1764167834, odf4 v4.17-1764167876, odf4 v4.17-1764167987, odf4 v4.17-1764168179, +12 more
    fixed: vendor fix RHSA-2025:22415
  • Red Hat Openshift Data Foundation 4.18 odf4 v4.18-1761854280, odf4 v4.18-1761854289, odf4 v4.18-1761854319, odf4 v4.18-1761854321, odf4 v4.18-1761854398, odf4 v4.18-1761854422, +12 more
    fixed: vendor fix RHSA-2025:21368
  • Red Hat Openshift Data Foundation 4.19 odf4 v4.19-1761832915, odf4 v4.19-1761832946, odf4 v4.19-1761832992, odf4 v4.19-1761833034, odf4 v4.19-1761833068, odf4 v4.19-1761833085, +13 more
    fixed: vendor fix RHSA-2025:21378
  • Red Hat Openshift Data Foundation 4.20 odf4 v4.20-1761728558, odf4 v4.20-1761728716, odf4 v4.20-1761728784, odf4 v4.20-1761728797, odf4 v4.20-1761728814, odf4 v4.20-1761728854, +16 more
    fixed: vendor fix RHSA-2025:21704
  • Red Hat RHINT Service Registry 2.3.0 GA
    fixed: vendor fix RHSA-2022:6835
  • Red Hat RHODF 4.11 for RHEL 8 odf4/odf-console-rhel8 v4.11.0-51
    fixed: vendor fix RHSA-2022:6156
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-prometheus, openshift-service-mesh/kiali-rhel8-operator 1.36.9-2, openshift-service-mesh/istio-must-gather-rhel8 2.1.2-3 Red Hat A-MQ Online follow-redirects Red Hat Ansible Automation Platform 1.2 follow-redirects Red Hat Ansible Automation Platform 2 follow-redirect
    not affected: vulnerable code not present

14 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.34% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm follow-redirects
<1.14.8
1.14.8

Affected products

  • follow-redirects follow-redirects/follow-redirects

Classification

Weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.