What’s Vulnerable › Products

follow-redirects vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your follow-redirects version is affected

Latest follow-redirects vulnerabilities

• CVE-2026-116689 — follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects (CVSS 5.9)
• CVE-2026-111756 — follow-redirects array-form headers bypass cross-origin credential stripping (CVSS 8.2)
• CVE-2026-111755 — follow-redirects sensitiveHeaders regex escaping can expose credential headers (CVSS 8.2)
• CVE-2026-40895 — follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets (CVSS 7.5)
• CVE-2024-28849 — Proxy-Authorization header kept across hosts in follow-redirects (CVSS 6.5)
• CVE-2022-0536 — Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects (CVSS 5.9)
• CVE-2022-0155 — Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects (CVSS 6.5)