follow-redirects vulnerabilities
HTTP and HTTPS modules that follow redirects.
- Registry
- npm
- Latest
- 1.16.1
- License
- MIT
7 known advisories
The latest version, 1.16.1, is not affected by any of them. Projects on older versions may be.
npm install follow-redirects@1.16.1Security advisories for follow-redirects
follow-redirects array-form headers bypass cross-origin credential stripping
- Affected
- >=1.16.0 <1.16.1
- Fixed in
- 1.16.1
follow-redirects sensitiveHeaders regex escaping can expose credential headers
- Affected
- >=1.16.0 <1.16.1
- Fixed in
- 1.16.1
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
- Affected
- <1.16.0
- Fixed in
- 1.16.0
follow-redirects' Proxy-Authorization header kept across hosts
- Affected
- <1.15.6
- Fixed in
- 1.15.6
Follow Redirects improperly handles URLs in the url.parse() function
- Affected
- <1.15.4
- Fixed in
- 1.15.4
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
- Affected
- <1.14.8
- Fixed in
- 1.14.8
Exposure of sensitive information in follow-redirects
- Affected
- <1.14.7
- Fixed in
- 1.14.7
Which of your client projects still run an old follow-redirects?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.