Follow Redirects
Monthly
follow-redirects 1.16.0 through 1.16.x before 1.16.1 can disclose Authorization, Proxy-Authorization, Cookie, and caller-declared sensitiveHeaders when an application supplies headers in Node's alternating name/value array form and follows an attacker-influenced redirect to a different host or a downgraded protocol. This is an unauthenticated confidentiality issue (CWE-200) with high credential impact, but exploitation is conditional because object-form headers are unaffected and the attacker must serve or influence the redirect; the supplied CVSS 4.0 score is 8.2, while the independent CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N captures the high attack complexity. No public exploit was identified at time of analysis, and no CISA KEV confirmation was present in the supplied data; the vendor patch is 1.16.1.
Credential header leakage in follow-redirects 1.16.0 allows remote attackers to receive sensitive headers that should have been stripped when a request follows a cross-origin or HTTPS-to-HTTP redirect to an attacker-controlled target. The flaw only manifests when an application explicitly declares a sensitive header whose name contains the regular-expression metacharacters ^ or |, so conventionally named headers and default configurations are not affected. The vendor fixed the issue in 1.16.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-origin credential leakage in follow-redirects 1.16.0 through 1.16.1 lets a custom credential header named in the sensitiveHeaders option be forwarded to an attacker-controlled redirect destination when that option is supplied as a genuine cross-realm array. Only direct callers or wrappers that pass a cross-realm array (for example one created via node:vm) are affected - same-realm arrays are handled correctly, built-in Authorization, Proxy-Authorization and Cookie stripping remained effective, and callers such as Axios 1.20.0 that normalize the array did not reproduce. The vendor released a patch in 1.16.2, and the advisory describes a loopback proof-of-concept harness that is held privately; there is no confirmed active exploitation (not in CISA KEV), and this is best treated as a conditional medium-severity disclosure rather than an urgent default-configuration issue.
Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whenever an HTTP request follows a cross-domain redirect. The header-stripping regex at index.js:469-476 only covers `authorization`, `proxy-authorization`, and `cookie`, leaving headers such as `X-API-Key`, `X-Auth-Token`, and `Token` forwarded verbatim to the redirect destination. Because follow-redirects is the redirect-handling dependency for axios (105K+ GitHub stars), this flaw has broad reach across the Node.js ecosystem; no public exploit code has been identified at time of analysis, though a fully detailed GHSA advisory with a working attack scenario is publicly available.
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
follow-redirects 1.16.0 through 1.16.x before 1.16.1 can disclose Authorization, Proxy-Authorization, Cookie, and caller-declared sensitiveHeaders when an application supplies headers in Node's alternating name/value array form and follows an attacker-influenced redirect to a different host or a downgraded protocol. This is an unauthenticated confidentiality issue (CWE-200) with high credential impact, but exploitation is conditional because object-form headers are unaffected and the attacker must serve or influence the redirect; the supplied CVSS 4.0 score is 8.2, while the independent CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N captures the high attack complexity. No public exploit was identified at time of analysis, and no CISA KEV confirmation was present in the supplied data; the vendor patch is 1.16.1.
Credential header leakage in follow-redirects 1.16.0 allows remote attackers to receive sensitive headers that should have been stripped when a request follows a cross-origin or HTTPS-to-HTTP redirect to an attacker-controlled target. The flaw only manifests when an application explicitly declares a sensitive header whose name contains the regular-expression metacharacters ^ or |, so conventionally named headers and default configurations are not affected. The vendor fixed the issue in 1.16.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-origin credential leakage in follow-redirects 1.16.0 through 1.16.1 lets a custom credential header named in the sensitiveHeaders option be forwarded to an attacker-controlled redirect destination when that option is supplied as a genuine cross-realm array. Only direct callers or wrappers that pass a cross-realm array (for example one created via node:vm) are affected - same-realm arrays are handled correctly, built-in Authorization, Proxy-Authorization and Cookie stripping remained effective, and callers such as Axios 1.20.0 that normalize the array did not reproduce. The vendor released a patch in 1.16.2, and the advisory describes a loopback proof-of-concept harness that is held privately; there is no confirmed active exploitation (not in CISA KEV), and this is best treated as a conditional medium-severity disclosure rather than an urgent default-configuration issue.
Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whenever an HTTP request follows a cross-domain redirect. The header-stripping regex at index.js:469-476 only covers `authorization`, `proxy-authorization`, and `cookie`, leaving headers such as `X-API-Key`, `X-Auth-Token`, and `Token` forwarded verbatim to the redirect destination. Because follow-redirects is the redirect-handling dependency for axios (105K+ GitHub stars), this flaw has broad reach across the Node.js ecosystem; no public exploit code has been identified at time of analysis, though a fully detailed GHSA advisory with a working attack scenario is publicly available.
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.