Vulnerabilities

TI-2026-81522 CVE-2026-116689 · GHSA-mrwp-f3q8-3g9p

Credential headers forwarded on redirects in follow-redirects

MEDIUM 60

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00266 Published 2026-10-27 Partial fix · 1.16.2 CWE-201

TI-2026-76983 CVE-2026-111756 · GHSA-q3jh-wrc6-jgq8

Credential headers leak across redirects in follow-redirects

HIGH 69

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00471 Published 2026-10-20 Partial fix · 1.16.1 CWE-200

TI-2026-76533 CVE-2026-111755 · GHSA-8r9p-f939-6h3c

Regex escaping flaw in follow-redirects leaks credential headers

HIGH 69

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00471 Published 2026-10-19 Partial fix · 1.16.1 CWE-185

TI-2026-29551 CVE-2026-40895

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

LOW 31

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00486 Published 2026-04-21 Partial fix · 1.16.0 CWE-200

TI-2024-19051 CVE-2024-28849 · GHSA-cxjh-pqwp-8mfp

Proxy-Authorization header kept across hosts in follow-redirects

MEDIUM 62

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01044 Published 2024-03-14 Partial fix · 1.15.6 CWE-200

TI-2023-11383 CVE-2023-26159 · GHSA-jchw-25xp-jwwc

Improper input validation in follow-redirects

HIGH 65

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00797 Published 2024-01-02 Partial fix · 1.15.4 CWE-20

TI-2022-00456 CVE-2022-0536 · GHSA-pw2r-vq6v-hr8c

Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects

LOW 29

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01337 Published 2022-02-09 Partial fix · 1.14.8 CWE-212

TI-2022-00097 CVE-2022-0155 · GHSA-74fj-2j2h-c42q

Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects

LOW 34

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02608 Published 2022-01-10 Partial fix · 1.14.7 CWE-359

Vulnerabilities

Filters