CVE-2023-26159: follow-redirects follow_redirects Improper Input Validation
Vulnerability summary
CVE-2023-26159 is a high (CVSS 7.3) Improper Input Validation vulnerability in follow-redirects follow_redirects. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.7% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 10Timeline
- 02-01-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
- OSV · NpmEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.80% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundFollow Redirects
Maturity: poc
Exploit Reference (security.snyk.io)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Affected systems
Chainguard36 products
- arangodb-3.11< 3.11.14.5-r5
- configurable-http-proxy< 4.6.1-r1
- kibana-7< 7.17.24-r0
- kubeflow-centraldashboard< 1.8.0-r1
- kubeflow-pipelines< 2.0.5-r2
Wolfi4 products
- configurable-http-proxy< 4.6.1-r1
- kubeflow-centraldashboard< 1.8.0-r1
- kubeflow-pipelines< 2.0.5-r2
- lerna< 8.0.2-r0
Debian1 product
- node-follow-redirectsAll versions (No fix recorded) | < 1.15.6+~1.14.4-1
Follow-redirects1 product
- follow_redirects< 1.15.4
Npm1 product
- follow-redirects< 1.15.4
Ubuntu1 product
- node-follow-redirects< 1.2.4-1ubuntu0.18.04.1~esm1 | < 1.2.4-1ubuntu0.20.04.1~esm1 | < 1.14.9+~1.14.1-1ubuntu0.1~esm1
6 vendors · 44 products
