Server-side request forgery through absolute redirect targets

An absolute URL in a redirect response is followed without re-applying the caller`s base-URL restriction, allowing a remote host to redirect an outbound request onto an internal address.

SyntheticThis advisory is invented for the demonstration. axios is a real package; nothing described here has been reported against it.