CVE-2024-28849

Summary

CVE-2024-28849 is a vulnerability affecting the follow-redirects package, which is used as a drop-in replacement for Node.js's `http` and `https` modules to automatically follow redirects. In specific versions of the package, authorization headers are cleared during cross-domain redirects, but proxy-authentication headers containing credentials are not. This issue may lead to unintended credential exposure. Users are advised to upgrade to version 1.15.6 to address the vulnerability, and no known workarounds exist.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.