CVE-2023-26159

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

• CWE-20
• CWE-601
• CWE-601

• https://github.com/follow-redirects/follow-redirects/issues/235Exploit, Issue Tracking
• https://github.com/follow-redirects/follow-redirects/pull/236Issue Tracking, Patch
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM/
• https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137Exploit, Third Party Advisory
• https://github.com/follow-redirects/follow-redirects/issues/235Exploit, Issue Tracking
• https://github.com/follow-redirects/follow-redirects/pull/236Issue Tracking, Patch
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM/
• https://security.netapp.com/advisory/ntap-20241108-0002/
• https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137Exploit, Third Party Advisory

Published

Jan 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26153Versions of the package geokit-rails before 2.5.0 are vulner…9.8
• CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of…5.9
• CVE-2023-26155All versions of the package node-qpdf are vulnerable to Comm…9.8
• CVE-2023-26156Versions of the package chromedriver before 119.0.1 are vuln…7.5
• CVE-2023-26157Versions of the package libredwg before 0.12.5.6384 are vuln…7.5
• CVE-2023-26158All versions of the package mockjs are vulnerable to Prototy…8.2
• CVE-2023-2616Cross-site Scripting (XSS) - Generic in GitHub repository pi…5.4
• CVE-2023-2617A vulnerability classified as problematic was found in OpenC…7.5
• CVE-2023-2618A vulnerability, which was classified as problematic, has be…7.5
• CVE-2023-2619A vulnerability, which was classified as critical, was found…9.8
• CVE-2023-2620An issue has been discovered in GitLab CE/EE affecting all v…3.8
• CVE-2023-26203A use of hard-coded credentials vulnerability [CWE-798] in F…7.8