Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

feross/simple-get

              master @ e7a7411
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Information Disclosure: 2 prior fixes. Scrutinize any change in this area.

index.js: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: The client failed to strip sensitive authentication and session headers when following redirects to external domains, allowing third-party hosts to capture user credentials. This represents a critical data exposure risk for any application utilizing this library for automated redirect handling.

Improper Certificate Validation: The global override of NODE_TLS_REJECT_UNAUTHORIZED in testing environments disabled SSL/TLS certificate validation globally, presenting a risk of accidental production bypasses or test environment vulnerabilities if mock configurations leaked.