medium 6.5

CVE-2024-28849 json

Proxy-Authorization header kept across hosts in follow-redirects

published 2024-03-14 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-0907 , GHSA-cxjh-pqwp-8mfp

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

fixed in 2 distros 5 links 1

npm follow-redirects 1.15.6
follow-redirects_project follow-redirects 1.15.6

debian ubuntu red hat opensuse azure linux

node-follow-redirects Debian 14, Debian 13 1.15.6+~1.14.4-1

debian advisories DEBIAN-CVE-2024-28849

node-follow-redirects Ubuntu Pro 18.04 LTS 1.2.4-1ubuntu0.18.04.1~esm1
node-follow-redirects Ubuntu Pro 20.04 LTS 1.2.4-1ubuntu0.20.04.1~esm1
node-follow-redirects Ubuntu Pro 22.04 LTS 1.14.9+~1.14.1-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2024-28849

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el8ap
receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el9ap
python-idna ansible automation platform developer 2.4, ansible automation platform 2.4 3.7-1.el9ap
receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el8ap
receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el9ap
python-black ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 22.8.0-2.el9ap
python3-idna ansible automation platform developer 2.4, ansible automation platform 2.4 3.7-1.el9ap
python-jinja2 ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 3.1.4-1.el9ap

red hat advisories RHSA-2024:3781

velociraptor openSUSE Tumbleweed 0.7.0.4.git74.3426c0a-5.1

opensuse advisories openSUSE-SU-2024:13830-1

reaper CBL-Mariner 2.0 3.1.1-9

azure linux advisories AZL-36895

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/follow-redirects/follow-redirects@c4f847f commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-28849 updated 2026-11-06 cvss 6.5

follow-redirects: Possible credential leak

Red Hat Cryostat 2 nodejs-follow-redirects
affected: no fix available “Fix deferred”
Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8
affected: no fix planned “Will not fix”
Red Hat Migration Toolkit for Applications 6 nodejs-follow-redirects Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9
affected: no fix available
Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8 Red Hat OpenShift Serverless nodejs-follow-redirects
affected: no fix planned “Will not fix”
Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8
affected: no fix available
Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8
affected: no fix planned “Will not fix”
Red Hat Ansible Automation Platform 2 automation-controller, aap-cloud-ui-container
affected: no fix available, no fix planned “Will not fix”
Red Hat build of Apicurio Registry 2 nodejs-follow-redirects
affected: no fix available

show 24 more

Red Hat Fuse 7 nodejs-follow-redirects Red Hat Integration Camel K 1 nodejs-follow-redirects Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/nmstate-console-plugin-rhel9
affected: no fix planned “Will not fix”
Red Hat OpenShift Data Science (RHODS) rhods/odh-dashboard-rhel8
affected: no fix available “Fix deferred”
Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces/traefik-rhel8
affected: no fix available, no fix planned “Will not fix”
Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8
affected: no fix planned “Will not fix”
Red Hat OpenShift distributed tracing 3 rhosdt/jaeger-agent-rhel8 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9
affected: no fix available
Red Hat Process Automation 7 nodejs-follow-redirects
affected: no fix planned “Will not fix”
Red Hat Quay 3 quay/quay-rhel8
affected: no fix available
Red Hat Cluster Observability Operator 1.0.0 cluster-observability-operator 1.0.0-1739789914
fixed: vendor fix RHSA-2025:1609
Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4
fixed: vendor fix RHSA-2024:3550
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8
fixed: vendor fix RHSA-2024:3920
Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.3-2, mta/mta-windup-addon-rhel9 6.2.3-2
fixed: vendor fix RHSA-2024:3989
Red Hat MTA 7.0 for RHEL 9 mta/mta-ui-rhel9 7.0.3-13, mta/mta-cli-rhel9 7.0.3-16
fixed: vendor fix RHSA-2024:3316
Red Hat multicluster engine for Kubernetes 2.5 for RHEL 9 multicluster-engine/console-mce-rhel9 v2.5.3-7, multicluster-engine/multicluster-engine-console-mce-rhel9 v2.5.3-7
fixed: vendor fix RHBA-2024:2862
Red Hat NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9 v1.6.0-66, network-observability/network-observability-operator-bundle 1.6.0-78, network-observability/network-observability-rhel9-operator v1.6.0-66, network-observability/network-observability-ebpf-agent-rhel9 v1.6.0-66, network-observability/network-observability-console-plugin-rhel9 v1.6.0-66, network-observability/network-observability-flowlogs-pipeline-rhel9 v1.6.0-66
fixed: vendor fix RHSA-2024:3868
Red Hat OpenShift Pipelines version 1.15 for RHEL 8 openshift-pipelines/pipelines-nop-rhel8 v1.15.0-17, openshift-pipelines/pipelines-events-rhel8 v1.15.0-20, openshift-pipelines/pipelines-hub-ui-rhel8 v1.15.0-17, openshift-pipelines/pipelines-cli-tkn-rhel8 v1.15.0-20, openshift-pipelines/pipelines-hub-api-rhel8 v1.15.0-18, openshift-pipelines/pipelines-webhook-rhel8 v1.15.0-19, +21 more
fixed: vendor fix RHEA-2024:3997
Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/console-rhel9 v2.10.2-3
fixed: vendor fix RHBA-2024:2034
Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-hub 4.9.2-1.el8ap, python39-galaxy-ng 4.9.2-1.el8ap, python3x-galaxy-ng 4.9.2-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-hub 4.9.2-1.el9ap, python-galaxy-ng 4.9.2-1.el9ap, python3-galaxy-ng 4.9.2-1.el9ap
fixed: vendor fix RHSA-2024:3781
Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 v1.8.4-10
fixed: vendor fix RHSA-2024:7164
Red Hat OpenShift Container Platform 4.16 openshift4/ose-monitoring-plugin-rhel9 v4.16.0-202406140306.p0.gf1fc431.assembly.stream.el9
fixed: vendor fix RHSA-2024:0041
Red Hat OpenShift GitOps 1.12 openshift-gitops-1/dex-rhel8 v1.12.6-2, openshift-gitops-1/argocd-rhel8 v1.12.6-2, openshift-gitops-1/argocd-rhel9 v1.12.6-1, openshift-gitops-1/gitops-rhel8 v1.12.6-2, openshift-gitops-1/must-gather-rhel8 v1.12.6-2, openshift-gitops-1/kam-delivery-rhel8 v1.12.6-2, +4 more
fixed: vendor fix RHSA-2024:8677
Red Hat RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.5.0-3, advanced-cluster-security/rhacs-roxctl-rhel8 4.5.0-2, advanced-cluster-security/rhacs-scanner-rhel8 4.5.0-2, advanced-cluster-security/rhacs-rhel8-operator 4.5.0-2, advanced-cluster-security/rhacs-collector-rhel8 4.5.0-2, advanced-cluster-security/rhacs-operator-bundle 4.5.0-3, +7 more
fixed: vendor fix RHSA-2024:4836
Red Hat RHOL 5.8 for RHEL 9 openshift-logging/fluentd-rhel9 v5.8.5-3, openshift-logging/vector-rhel9 v0.28.1-56, openshift-logging/eventrouter-rhel9 v0.4.0-236, openshift-logging/logging-loki-rhel9 v2.9.4-22, openshift-logging/loki-rhel9-operator v5.8.5-12, openshift-logging/loki-operator-bundle v5.8.5-23, +11 more
fixed: vendor fix RHSA-2024:1474
Red Hat RHOSSM 2.5 for RHEL 8 openshift-service-mesh/pilot-rhel8 2.5.1-8, openshift-service-mesh/kiali-rhel8 1.73.7-5, openshift-service-mesh/grafana-rhel8 2.5.1-2, openshift-service-mesh/proxyv2-rhel8 2.5.1-8, openshift-service-mesh/istio-cni-rhel8 2.5.1-8, openshift-service-mesh/ratelimit-rhel8 2.5.1-2, +4 more
fixed: vendor fix RHSA-2024:1946
Red Hat Cluster Observability Operator 1.0.0 cluster-observability-operator 1.0.0-1739195312, cluster-observability-operator 1.0.0-1739195316, cluster-observability-operator 1.0.0-1739195441, cluster-observability-operator 1.0.0-1739195698, cluster-observability-operator 1.0.0-1739195862, cluster-observability-operator 1.0.0-1739195977, +7 more Red Hat MTA 6.2 for RHEL 8 mta/mta-hub-rhel9 6.2.3-1, mta/mta-rhel8-operator 6.2.3-1, mta/mta-operator-bundle 6.2.3-4, mta/mta-pathfinder-rhel9 6.2.3-1
not affected: vulnerable code not present

21 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-08-02)

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	follow-redirects	<1.15.6	1.15.6

Affected products

follow-redirects follow-redirects
follow-redirects_project follow-redirects

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

github.com /follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b
web, patch
github.com /follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp
web, exploit, vendor-advisory
github.com /psf/requests/issues/1885
web, issue-tracking
hackerone.com /reports/2390009
web, issue-tracking, third-party-advisory
fetch.spec.whatwg.org /#authentication-entries
web, technical-description
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z/
mailing-list, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2024-28849
advisory
github.com /follow-redirects/follow-redirects
package
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary