follow-redirects
npm8 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting follow-redirectspage 1 of 1
- CVE-2022-0155HIGHCVSS 6.5EG 8.0fixed in 1.14.72022-01-10
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
- CVE-2022-0536MEDIUMCVSS 2.6EG 5.9fixed in 1.14.82022-02-09
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
- CVE-2023-26159HIGHCVSS 7.3EG 7.3fixed in 1.15.42024-01-02
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the …
- CVE-2024-28849MEDIUMCVSS 6.5EG 6.5fixed in 1.15.62024-03-14
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but ke…
- CVE-2026-111755HIGHCVSS 8.2EG 8.2fixed in 1.16.12026-10-19
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a s…
- CVE-2026-111756HIGHCVSS 8.2EG 8.2fixed in 1.16.12026-10-20
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cook…
- CVE-2026-116689MEDIUMCVSS 5.9EG 5.9fixed in 1.16.22026-10-27
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaS…
- CVE-2026-40895HIGHCVSS 7.5EG 7.5fixed in 1.16.02026-04-21
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects o…
Check whether follow-redirects is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for follow-redirects CVEs against the assets you own.
Book a Demo →