Security vulnerabilities and automated fixes for http redirects issues
2 posts found
CVE-2026-54673 is a high-severity information disclosure vulnerability in `electron-updater` (via `builder-util-runtime`) where credential headers are not stripped before following HTTP redirects, potentially exposing authentication tokens to unintended servers. The vulnerability was present in `builder-util-runtime@9.5.1` and was resolved by upgrading to `9.7.0`. This fix is critical for any Electron application that uses auto-update functionality against endpoints that may issue redirects.
A medium-severity vulnerability (CVE-2025-50182) was discovered in urllib3 that fails to properly control HTTP redirects in browsers and Node.js environments. This flaw could allow attackers to redirect users to malicious sites or bypass security controls through crafted redirect chains. The vulnerability has been patched in the latest urllib3 release, and developers should update their dependencies immediately.