{"id":"CVE-2023-26159","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-26159","generatedAt":"2026-10-24T02:02:35.912Z","title":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function.","description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","published":"2024-01-02T05:15:09.000Z","lastModified":"2026-06-17T05:42:49.000Z","status":"Modified","sourceIdentifier":"report@snyk.io","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-20","CWE-601"],"affected":["follow-redirects/follow redirects"],"epss":{"score":0.00797,"percentile":0.56035,"date":"2026-10-22","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.80%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/follow-redirects/follow-redirects/issues/235","tags":["Exploit","Issue Tracking"],"source":"report@snyk.io"},{"url":"https://github.com/follow-redirects/follow-redirects/pull/236","tags":["Issue Tracking","Patch"],"source":"report@snyk.io"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM/","source":"report@snyk.io"},{"url":"https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137","tags":["Exploit","Third Party Advisory"],"source":"report@snyk.io"},{"url":"https://github.com/follow-redirects/follow-redirects/issues/235","tags":["Exploit","Issue Tracking"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/follow-redirects/follow-redirects/pull/236","tags":["Issue Tracking","Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-26159","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}