GHSA-x565-32qp-m3vf: 
JavaScript vulnerability analysis and mitigation

A moderate severity vulnerability (GHSA-x565-32qp-m3vf) was identified in the phin npm package affecting versions prior to 3.7.1. The vulnerability, discovered and disclosed on April 11, 2024, involves the potential exposure of sensitive header information during redirect requests. The issue specifically affects scenarios where the followRedirects option is enabled (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 score of 4.3 (Moderate), with the following characteristics: Network attack vector, Low attack complexity, No privileges required, User interaction Required, Unchanged scope, Low confidentiality impact, and No impact on integrity or availability. The vulnerability is classified under CWE-200. The technical issue stems from the way phin handles headers during redirect operations when the followRedirects feature is enabled (GitHub Advisory).

The vulnerability can lead to the exposure of sensitive information contained in request headers when redirects are followed. This particularly affects users who send requests containing sensitive data in specific headers while having the followRedirects feature enabled (GitHub Advisory).

The vulnerability requires network access and user interaction to be exploited. While the attack complexity is low, the impact is primarily limited to confidentiality breaches with no known effects on integrity or availability (GitHub Advisory).

The vulnerability has been patched in version 3.7.1 of the phin package. The fix implements the follow-redirects library to handle redirects and properly remove potentially sensitive headers. Users are strongly advised to update to version 3.7.1 or later, as no alternative workarounds are available (GitHub Commit).