REDHAT-BUG-2460297: High severity npm/follow-redirects vulnerability
follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
follow-redirectsto a version that resolves this vulnerability.Fixed in 1.16.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2460297?
The severity of REDHAT-BUG-2460297 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2460297?
To fix REDHAT-BUG-2460297, update the follow-redirects package to version 1.16.0 or higher.
What is the impact of REDHAT-BUG-2460297?
The impact of REDHAT-BUG-2460297 is that sensitive headers may be exposed when following cross-domain redirects.
Which software is affected by REDHAT-BUG-2460297?
The software affected by REDHAT-BUG-2460297 is npm's follow-redirects module.
When was REDHAT-BUG-2460297 published?
REDHAT-BUG-2460297 was published on April 21, 2026.