PatchTheCVECVE-2023-26159: Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the
CVE-2023-26159 is a high-severity flaw (CVSS 7.3) affecting follow redirects. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-26159?
follow redirects: upgrade to 1.15.4. Exact commands for each OS are on this page.
Is CVE-2023-26159 being exploited?
CVE-2023-26159 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-26159 affect?
CVE-2023-26159 affects follow redirects. Severity is high (CVSS 7.3). Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the h
How urgent is CVE-2023-26159?
Priority 50/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action