TI-2026-76983 CVE-2026-111756 · GHSA-q3jh-wrc6-jgq8
Credential headers leak across redirects in follow-redirects
Priority HIGH 69
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects.
follow-redirects
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
follow-redirects records in CISA KEVNo follow-redirects vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2026-76533 CVE-2026-111755 · GHSA-8r9p-f939-6h3c
Regex escaping flaw in follow-redirects leaks credential headers
Priority HIGH 69
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects.
TI-2023-11383 CVE-2023-26159 · GHSA-jchw-25xp-jwwc
Improper input validation in follow-redirects
Priority HIGH 65
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function.
TI-2024-19051 CVE-2024-28849 · GHSA-cxjh-pqwp-8mfp
Proxy-Authorization header kept across hosts in follow-redirects
Priority MEDIUM 62
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.
TI-2026-81522 CVE-2026-116689 · GHSA-mrwp-f3q8-3g9p
Credential headers forwarded on redirects in follow-redirects
Priority MEDIUM 60
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects.
TI-2022-00097 CVE-2022-0155 · GHSA-74fj-2j2h-c42q
Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects
Priority LOW 34
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
TI-2026-29551 CVE-2026-40895
follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets
Priority LOW 31
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.
TI-2022-00456 CVE-2022-0536 · GHSA-pw2r-vq6v-hr8c
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Priority LOW 29
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.