Is follow-redirects 1.14 vulnerable?
npm · 10 releases from 1.14.0 to 1.14.9 · latest follow-redirects is 1.16.2 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. follow-redirects 1.14.9, the last 1.14 release, is affected by 3 known security advisories (3 medium), including CVE-2026-40895, CVE-2024-28849, CVE-2023-26159. 2 more affect earlier 1.14.x releases. Upgrade to 1.16.0 or later to fix all of them.
npm install follow-redirects@1.16.0Advisories affecting follow-redirects 1.14.9
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
- Affected
- <1.16.0
- Fixed in
- 1.16.0
follow-redirects' Proxy-Authorization header kept across hosts
- Affected
- <1.15.6
- Fixed in
- 1.15.6
Follow Redirects improperly handles URLs in the url.parse() function
- Affected
- <1.15.4
- Fixed in
- 1.15.4
Fixed within 1.14.x, affecting earlier releases
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
- Affected
- <1.14.8
- Fixed in
- 1.14.8
Exposure of sensitive information in follow-redirects
- Affected
- <1.14.7
- Fixed in
- 1.14.7
Which of your client projects are still on follow-redirects 1.14?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact follow-redirects version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other follow-redirects versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.