AIKIDO-2026-154218
follow-redirects is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
53
Medium Risk
This Affects:
follow-redirectsTL;DR
The sensitiveHeaders option in follow-redirects lets callers name extra credential headers to strip on cross origin redirects. The library passes each name through escapeRegex and joins them into one case insensitive regular expression, but escapeRegex leaves ^, |, [, {, and } unescaped. A declared header name containing ^ or |, both valid RFC 9110 token characters, produces a pattern that never matches the header, so the application forwards that credential header unchanged to the redirected destination with no error. The fix escapes the remaining regular expression metacharacters in escapeRegex.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you declare a custom sensitiveHeaders entry whose name contains a regular expression metacharacter such as ^ or |.
Background info
follow-redirects is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 1.16.0 - 1.16.0.
How to fix this
Upgrade the follow-redirects library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.