CVE-2024-28849mediumCWE-200

CVE-2024-28849: medium-severity vulnerability in follow-redirects

Proxy-Authorization header kept across hosts in follow-redirects

Published · Updated

Follow this CVE+ Monitor follow-redirects+ Monitor node-follow-redirects

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.0%
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
follow-redirects · follow-redirects
Related CVEs — follow-redirects

In the same product, most dangerous first.

CVE-2026-40895MEDIUMfollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsEPSS 0.5%CVE-2026-111756HIGHfollow-redirects array-form headers bypass cross-origin credential strippingEPSS 0.5%CVE-2026-111755HIGHfollow-redirects sensitiveHeaders regex escaping can expose credential headersEPSS 0.5%CVE-2026-116689MEDIUMfollow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsEPSS 0.3%