Is follow-redirects 1.15 vulnerable?
npm · 12 releases from 1.15.0 to 1.15.11 · latest follow-redirects is 1.16.2 · checked 1 Nov 2026
Yes: 1 known advisory
Yes. follow-redirects 1.15.11, the last 1.15 release, is affected by 1 known security advisory (1 medium), including CVE-2026-40895. 2 more affect earlier 1.15.x releases. Upgrade to 1.16.0 or later to fix all of them.
npm install follow-redirects@1.16.0Advisories affecting follow-redirects 1.15.11
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
- Affected
- <1.16.0
- Fixed in
- 1.16.0
Fixed within 1.15.x, affecting earlier releases
follow-redirects' Proxy-Authorization header kept across hosts
- Affected
- <1.15.6
- Fixed in
- 1.15.6
Follow Redirects improperly handles URLs in the url.parse() function
- Affected
- <1.15.4
- Fixed in
- 1.15.4
Which of your client projects are still on follow-redirects 1.15?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact follow-redirects version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other follow-redirects versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.