[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
follow-redirects	>=1.15.9 → >=1.16.1

---

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

GHSA-r4q5-vmmm-2653

More information

Details

Summary

When an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target.

Since follow-redirects is the redirect-handling dependency for axios (105K+ stars), this vulnerability affects the entire axios ecosystem.

Affected Code

index.js, lines 469-476:

if (redirectUrl.protocol !== currentUrlParts.protocol &&
   redirectUrl.protocol !== "https:" ||
   redirectUrl.host !== currentHost &&
   !isSubdomain(redirectUrl.host, currentHost)) {
  removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
}

The regex only matches authorization, proxy-authorization, and cookie. Custom headers like X-API-Key are not matched.

Attack Scenario

1. App uses axios with custom auth header: headers: { 'X-API-Key': 'sk-live-secret123' }
2. Server returns 302 Location: https://evil.com/steal
3. follow-redirects sends X-API-Key: sk-live-secret123 to evil.com
4. Attacker captures the API key

Impact

Any custom auth header set via axios leaks on cross-domain redirect. Extremely common pattern. Affects all axios users in Node.js.

Suggested Fix

Add a sensitiveHeaders option that users can extend, or strip ALL non-standard headers on cross-domain redirect.

Disclosure

Source code review, manually verified. Found 2026-03-20.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653
• https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9
• https://github.com/advisories/GHSA-r4q5-vmmm-2653

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

follow-redirects/follow-redirects (follow-redirects)

v1.16.1

Compare Source

v1.16.0

Compare Source

v1.15.11

Compare Source

v1.15.10

Compare Source

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​storm-software/​workspace-tools@​1.291.2 ⏵ 1.297.15	-34			-4
	@​storm-software/​unbuild@​0.56.14 ⏵ 0.57.307	-15			+1
	@​storm-software/​pnpm-tools@​0.5.7 ⏵ 0.7.160	-33		-4	-3
	@​storm-software/​git-tools@​2.122.14 ⏵ 2.132.3	-13			+1
	conventional-changelog-storm-software@​0.2.14 ⏵ 0.3.307	-11			+2
	@​storm-software/​build-tools@​0.158.306
	@​storm-software/​config-tools@​1.190.146
	@​storm-software/​tsconfig@​0.46.7 ⏵ 0.48.212	-24		-1	-2
	@​storm-software/​eslint@​0.168.14 ⏵ 0.170.181	-24		-1	-2
	@​storm-software/​cspell@​0.44.7 ⏵ 0.46.213	-23		-1	-2
	@​storm-software/​tsdoc@​0.12.8 ⏵ 0.13.298				+1
	@​storm-software/​testing-tools@​1.118.8 ⏵ 1.119.298	+1			+1
	@​storm-software/​markdownlint@​0.29.8 ⏵ 0.30.301	+1			+1
	@​storm-software/​untyped@​0.22.8 ⏵ 0.24.288	-21		-1	-2
	@​storm-software/​esbuild@​0.52.14 ⏵ 0.53.307	+8			+1
	@​storm-software/​linting-tools@​1.131.8 ⏵ 1.134.76	-3			+1
	@​storm-software/​prettier@​0.56.7 ⏵ 0.59.199	+4		+1	+1
	@​storm-software/​config@​1.138.82

View full report

[deepsource-io]

DeepSource Code Review

We reviewed changes in 242a5a8...37d9b18 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 25, 2026 2:35a.m.	Review ↗
Shell		Oct 25, 2026 2:35a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.