Vulnerabilities

TI-2026-29551 CVE-2026-40895

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

LOW 31

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00486 Published 2026-04-21 Partial fix · 1.16.0 CWE-200

TI-2024-19051 CVE-2024-28849 · GHSA-cxjh-pqwp-8mfp

MEDIUM 62

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01044 Published 2024-03-14 Partial fix · 1.15.6 CWE-200

TI-2022-00456 CVE-2022-0536 · GHSA-pw2r-vq6v-hr8c

LOW 29

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01337 Published 2022-02-09 Partial fix · 1.14.8 CWE-212

TI-2022-00097 CVE-2022-0155 · GHSA-74fj-2j2h-c42q

LOW 34

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02608 Published 2022-01-10 Partial fix · 1.14.7 CWE-359