affected:
- package:
    ecosystem: PyPI
    name: pyquest
    purl: pkg:pypi/pyquest
  ranges:
  - events:
    - introduced: '0'
    - fixed: 0c99bc511533d48be17dc6bfe641f7d0aeb34d77
    - fixed: 125e4474f910c1507f8ec3232848626fbc0f55c4
    repo: https://github.com/fluture-js/fluture-node
    type: GIT
  - events:
    - introduced: '0'
    type: ECOSYSTEM
  versions:
  - 0.0.1
aliases:
- CVE-2022-24719
- GHSA-32x6-qvw6-mxj4
details: Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture.
  Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies
  built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential
  headers such as Authorization or Cookie, exposes you to a vulnerability where, if
  the destination server were to redirect the request to a server on a third-party
  domain, or the same domain over unencrypted HTTP, the headers would be included
  in the follow-up request and be exposed to the third party, or potential http traffic
  sniffing. The redirection strategies made available in version 4.0.2 automatically
  redact confidential headers when a redirect is followed across to another origin.
  A workaround has been identified by using a custom redirection strategy via the
  `followRedirectsWith` function. The custom strategy can be based on the new strategies
  available in fluture-node@4.0.2.
id: PYSEC-2022-43051
modified: '2026-06-24T16:50:42.151987Z'
published: '2022-03-01T21:15:00Z'
references:
- type: FIX
  url: https://github.com/fluture-js/fluture-node/commit/0c99bc511533d48be17dc6bfe641f7d0aeb34d77
- type: FIX
  url: https://github.com/fluture-js/fluture-node/commit/125e4474f910c1507f8ec3232848626fbc0f55c4
- type: FIX
  url: https://github.com/psf/requests/pull/4718
- type: WEB
  url: https://github.com/psf/requests/pull/4718
- type: FIX
  url: https://github.com/fluture-js/fluture-node/security/advisories/GHSA-32x6-qvw6-mxj4
- type: ADVISORY
  url: https://github.com/fluture-js/fluture-node/security/advisories/GHSA-32x6-qvw6-mxj4
withdrawn: '2026-06-24T16:37:00Z'