CVE-2022-0155: 
JavaScript vulnerability analysis and mitigation

CVE-2022-0155 affects the follow-redirects package and involves the exposure of private personal information to unauthorized actors. The vulnerability was discovered in January 2022 and impacts systems using the follow-redirects library when fetching remote URLs with cookies (NVD, CVE).

The vulnerability exists in the follow-redirects package's handling of cookies during URL redirections. When fetching a remote URL with a cookie and encountering a Location response header for redirection, the package would inappropriately forward cookie information across domains (GitHub Commit).

The vulnerability could lead to the exposure of sensitive cookie information to unauthorized domains during URL redirections, potentially compromising user privacy and security. This could allow malicious actors to capture authentication tokens or other sensitive information stored in cookies (Broadcom).

The issue was fixed in follow-redirects by dropping cookie headers when redirecting to different domains. The fix was implemented by modifying the header removal logic to include cookie headers alongside authorization headers when redirecting across domains. Users should upgrade to patched versions of the package (GitHub Commit).