GHSA-x565-32qp-m3vf phin may include sensitive headers in subsequent requests after redirect
The phin library may leak sensitive headers to unintended destinations during redirects, exposing confidential data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-x565-32qp-m3vf?
GHSA-x565-32qp-m3vf is a vulnerability in phin, published on 11 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Users may be impacted if sending requests including sensitive data in specific headers with followRedirects enabled.
Patches
The follow-redirects library is now being used for redirects and removes some headers that may contain sensitive information in some situations.
Workarounds
N/A. Please update to resolve the issue.
Which versions are affected by GHSA-x565-32qp-m3vf?
2 open source packages ship an affected version, including phin.
| Package | Affected | Fixed in |
|---|---|---|
phin npm | All versions | 3.7.1 |
phin npm | All versions | 3.7.1 |
How do I fix GHSA-x565-32qp-m3vf?
Upgrade phin to 3.7.1 or later.
Is GHSA-x565-32qp-m3vf being exploited?
There is no known exploitation of GHSA-x565-32qp-m3vf in the wild and no public exploit code.