Follow-redirects vulnerabilities
We track 3 vulnerabilities in Follow-redirects products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest Follow-redirects vulnerabilities
- 8.2 High severity
follow-redirects: Exposure of Sensitive Information to an Unauthorized Actor
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-de
- 8.2 High severity
follow-redirects: Incorrect Regular Expression
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose
- 7.5 High severity
follow-redirects: Exposure of Sensitive Information to an Unauthorized Actor
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorizat