Follow-redirects vulnerabilities

Products

• Follow-redirects 6
• Follow-redirects/follow-redirects 2

Newest

• follow-redirects follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects CVE-2026-116689 Fix available 5.9 MediumOctober 27, 2026
• follow-redirects follow-redirects array-form headers bypass cross-origin credential stripping CVE-2026-111756 Fix available 8.2 HighOctober 20, 2026
• follow-redirects follow-redirects sensitiveHeaders regex escaping can expose credential headers CVE-2026-111755 Fix available 8.2 HighOctober 19, 2026
• follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 more follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets CVE-2026-40895 Fix available 6.9 MediumApril 14, 2026
• follow-redirects Proxy-Authorization header kept across hosts in follow-redirects CVE-2024-28849 Fix available 6.5 MediumMarch 14, 2024
• follow-redirects, follow-redirects follow redirects +1 more Follow Redirects improperly handles URLs in the url.parse() function CVE-2023-26159 Fix available 7.3 HighJanuary 2, 2024
• follow-redirects follow-redirects/follow-redirects, follow-redirects project follow-redirects +1 more Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects CVE-2022-0536 Fix available 2.6 LowFebruary 9, 2022
• follow-redirects follow-redirects/follow-redirects, follow-redirects project follow-redirects, siemens sinec ins +2 more Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects CVE-2022-0155 Public exploitFix available 8.0 HighJanuary 10, 2022