follow-redirects

Everything NetSec Observer has reported about follow-redirects: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

npm follow-redirects 1.16.1 fixes credential leak in array header handling

A high-severity flaw in follow-redirects versions 1.16.0 through 1.16.0.99 allows remote servers to harvest authentication headers when applications use array-based header formats.

Oct 21, 2026

Vulnerabilities

Node.js follow-redirects CVE-2026-111755 Exposes Credentials in Redirects

A regex flaw in follow-redirects 1.16.0 allows sensitive headers to leak to attacker-controlled targets during cross-origin redirects.

Oct 19, 2026