# follow-redirects (npm) vulnerabilities 8 known vulnerabilities (4 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.16.2 (Oct 25, 2026): no advisory affects it - Newest unaffected release: 1.16.2 (Oct 25, 2026), the latest release - Weekly downloads: 144.5M - Dependents: 369.3K - Releases: 73 since 0.0.1 (Nov 15, 2012) - Registry: https://www.npmjs.com/package/follow-redirects - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-116689: 1.16.0 to 1.16.1 (1.16.2 is outside it) - CVE-2026-111756: 1.16.0 (1.16.1 is outside it) - CVE-2026-111755: 1.16.0 (1.16.1 is outside it) - CVE-2026-40895: 0.0.1 to 1.15.11 (1.16.0 is outside it) - CVE-2024-28849: 0.0.1 to 1.15.5 (1.15.6 is outside it) - CVE-2023-26159: 0.0.1 to 1.15.3 (1.15.4 is outside it) - CVE-2022-0536: 0.0.1 to 1.14.7 (1.14.8 is outside it) - CVE-2022-0155: 0.0.1 to 1.14.6 (1.14.7 is outside it) ## Advisories (8) ### [CVE-2026-116689](https://cve.now/CVE-2026-116689): follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects - Severity: Medium 5.9 - Published: Oct 27, 2026 - Affected: from 1.16.0, fixed in 1.16.2. - Fixed in 1.16.2 (released Oct 25, 2026, 2 days before disclosure). - The latest release, 1.16.2, is not affected. - 40% of follow-redirects downloads last week were affected versions (65.3M). ### [CVE-2026-111756](https://cve.now/CVE-2026-111756): follow-redirects array-form headers bypass cross-origin credential stripping - Severity: High 8.2 - Published: Oct 20, 2026 - Affected: from 1.16.0, fixed in 1.16.1. - Fixed in 1.16.1 (released Oct 1, 2026, 19 days before disclosure). - The latest release, 1.16.2, is not affected. - 27% of follow-redirects downloads last week were affected versions (45.3M). ### [CVE-2026-111755](https://cve.now/CVE-2026-111755): follow-redirects sensitiveHeaders regex escaping can expose credential headers - Severity: High 8.2 - Published: Oct 19, 2026 - Affected: from 1.16.0, fixed in 1.16.1. - Fixed in 1.16.1 (released Oct 1, 2026, 18 days before disclosure). - The latest release, 1.16.2, is not affected. - 27% of follow-redirects downloads last week were affected versions (45.3M). ### [CVE-2026-40895](https://cve.now/CVE-2026-40895): follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets - Severity: Medium 6.9 - Published: Apr 21, 2026 - Affected: fixed in 1.16.0. - Fixed in 1.16.0 (released Apr 13, 2026, 8 days before disclosure). - The latest release, 1.16.2, is not affected. - 33% of follow-redirects downloads last week were affected versions (53.9M). ### [CVE-2024-28849](https://cve.now/CVE-2024-28849): Proxy-Authorization header kept across hosts in follow-redirects - Severity: Medium 6.5 - Published: Mar 14, 2024 - Affected: fixed in 1.15.6. - Fixed in 1.15.6 (released Mar 14, 2024, the day of disclosure). - The latest release, 1.16.2, is not affected. - 6.4% of follow-redirects downloads last week were affected versions (10.5M). ### [CVE-2023-26159](https://cve.now/CVE-2023-26159): Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by… - Severity: High 7.3 - Published: Jan 2, 2024 - Affected: fixed in 1.15.4. - Fixed in 1.15.4 (released Dec 30, 2023, 3 days before disclosure). - The latest release, 1.16.2, is not affected. - 5.7% of follow-redirects downloads last week were affected versions (9.4M). ### [CVE-2022-0536](https://cve.now/CVE-2022-0536): Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects - Severity: Low 2.6 - Published: Feb 9, 2022 - Affected: fixed in 1.14.8. - Fixed in 1.14.8 (released Feb 8, 2022, 1 day before disclosure). - The latest release, 1.16.2, is not affected. - 2.6% of follow-redirects downloads last week were affected versions (4.3M). ### [CVE-2022-0155](https://cve.now/CVE-2022-0155): Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects - Severity: High 8.0 - Published: Jan 10, 2022 - Affected: fixed in 1.14.7. - Fixed in 1.14.7 (released Jan 10, 2022, the day of disclosure). - The latest release, 1.16.2, is not affected. - 2.5% of follow-redirects downloads last week were affected versions (4.2M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/follow-redirects Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.