mirror of
https://github.com/nvm-sh/nvm.git
synced 2026-10-25 16:03:56 +08:00
e780535240
curl 7.58.0 and later drop a custom Authorization header when a redirect leads to another host, but wget sends `--header` along to every redirect target, so on a machine without curl, a mirror that redirected elsewhere handed the credential to that other host. When a header is sent with GNU Wget, run it with `--max-redirect=0`. When it then exits with 8 (an HTTP error, which includes a redirect it did not follow), read the `Location` with one more request, and re-request it only if it keeps the same scheme, host, and port, up to 20 times. A redirect to another origin, including a downgrade to `http`, fails with exit code 8 and an error that names the URL nvm requested and suggests curl. `--max-redirect` is not a BusyBox wget option, so other wgets are invoked as before; the README says so Discovered by Anthropic's OSS Scanner, as ANT-2026-PKUZHTT3; the scanner reported it as a vulnerability, but it is not one.