Is follow-redirects 1.16 vulnerable?
npm · 3 releases from 1.16.0 to 1.16.2 · latest follow-redirects is 1.16.2 · checked 2 Nov 2026
No known advisories in the last release
follow-redirects 1.16.2, the last 1.16 release, has no known advisories. 3 advisories affect earlier 1.16.x releases, so update to 1.16.2.
npm install follow-redirects@1.16.2Fixed within 1.16.x, affecting earlier releases
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
- Affected
- >=1.16.0 <1.16.2
- Fixed in
- 1.16.2
follow-redirects array-form headers bypass cross-origin credential stripping
- Affected
- >=1.16.0 <1.16.1
- Fixed in
- 1.16.1
follow-redirects sensitiveHeaders regex escaping can expose credential headers
- Affected
- >=1.16.0 <1.16.1
- Fixed in
- 1.16.1
Which of your client projects are still on follow-redirects 1.16?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact follow-redirects version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other follow-redirects versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.