AIKIDO-2026-27767
@tinyhttp/res is vulnerable to Open Redirect
43
Medium Risk
This Affects:
@tinyhttp/resTL;DR
The setLocationHeader helper used by res.redirect() and res.location() matches the scheme and authority of a URL with a regular expression that permits backslashes and only encodes the path portion. A user-controlled redirect target such as https://evil.com\@trusted.com is written to the Location header with the backslash left raw. Some URL parsers treat the backslash like a forward slash and resolve the destination to the attacker-controlled host, bypassing redirect allowlists and enabling phishing or OAuth code theft. The fix encodes the backslash to %5C while leaving the legitimate host verbatim, matching Express behavior.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes user-controlled input to res.redirect() or res.location().
Background info
@tinyhttp/res is vulnerable to Open Redirect in versions 2.2.11 - 2.2.12.
How to fix this
Upgrade the @tinyhttp/res library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant