npmPackage

follow-redirects

8 known vulnerabilities (4 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 1.16.2 (Oct 25, 2026): no advisory affects it
Newest unaffected release: 1.16.2 (Oct 25, 2026), the latest release
Advisories: 8 · 4 high, 3 medium, 1 low

Weekly downloads: 144.5M
Dependents: 369.3K
Releases: 73 since 0.0.1 (Nov 15, 2012)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-116689
Affects 1.16.0 to 1.16.1 (1.16.2 is outside it)
CVE-2026-111756
Affects 1.16.0 (1.16.1 is outside it)
CVE-2026-111755
Affects 1.16.0 (1.16.1 is outside it)
CVE-2026-40895
Affects 0.0.1 to 1.15.11 (1.16.0 is outside it)
CVE-2024-28849
Affects 0.0.1 to 1.15.5 (1.15.6 is outside it)
CVE-2023-26159
Affects 0.0.1 to 1.15.3 (1.15.4 is outside it)
CVE-2022-0536
Affects 0.0.1 to 1.14.7 (1.14.8 is outside it)
CVE-2022-0155
Affects 0.0.1 to 1.14.6 (1.14.7 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-116689Medium 5.9
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
Affected: from 1.16.0, fixed in 1.16.2.
Fixed in 1.16.2 (released Oct 25, 2026, 2 days before disclosure).
The latest release, 1.16.2, is not affected.
40% of follow-redirects downloads last week were affected versions (65.3M).
CVE-2026-111756High 8.2
follow-redirects array-form headers bypass cross-origin credential stripping
Affected: from 1.16.0, fixed in 1.16.1.
Fixed in 1.16.1 (released Oct 1, 2026, 19 days before disclosure).
The latest release, 1.16.2, is not affected.
27% of follow-redirects downloads last week were affected versions (45.3M).
CVE-2026-111755High 8.2
follow-redirects sensitiveHeaders regex escaping can expose credential headers
Affected: from 1.16.0, fixed in 1.16.1.
Fixed in 1.16.1 (released Oct 1, 2026, 18 days before disclosure).
The latest release, 1.16.2, is not affected.
27% of follow-redirects downloads last week were affected versions (45.3M).
CVE-2026-40895Medium 6.9
follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets
Affected: fixed in 1.16.0.
Fixed in 1.16.0 (released Apr 13, 2026, 8 days before disclosure).
The latest release, 1.16.2, is not affected.
33% of follow-redirects downloads last week were affected versions (53.9M).
CVE-2024-28849Medium 6.5
Proxy-Authorization header kept across hosts in follow-redirects
Affected: fixed in 1.15.6.
Fixed in 1.15.6 (released Mar 14, 2024, the day of disclosure).
The latest release, 1.16.2, is not affected.
6.4% of follow-redirects downloads last week were affected versions (10.5M).
CVE-2023-26159High 7.3
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by…
Affected: fixed in 1.15.4.
Fixed in 1.15.4 (released Dec 30, 2023, 3 days before disclosure).
The latest release, 1.16.2, is not affected.
5.7% of follow-redirects downloads last week were affected versions (9.4M).
CVE-2022-0536Low 2.6
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Affected: fixed in 1.14.8.
Fixed in 1.14.8 (released Feb 8, 2022, 1 day before disclosure).
The latest release, 1.16.2, is not affected.
2.6% of follow-redirects downloads last week were affected versions (4.3M).
CVE-2022-0155High 8.0
Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects
Affected: fixed in 1.14.7.
Fixed in 1.14.7 (released Jan 10, 2022, the day of disclosure).
The latest release, 1.16.2, is not affected.
2.5% of follow-redirects downloads last week were affected versions (4.2M).