follow-redirects Library Vulnerability Exposes Authentication Headers
A critical flaw in the follow-redirects npm package could lead to credential disclosure across web applications. Developers should update immediately to prevent cross-domain header leakage.
TL;DR
- Vulnerability affects follow-redirects npm package used by many Node.js applications
- Custom authentication headers improperly handled during cross-domain redirects
- Attackers can exploit this to steal sensitive credentials and tokens
- Immediate update to patched versions recommended for all users
- Affects popular frameworks and applications using this dependency
A newly discovered vulnerability in the widely-used follow-redirects npm package poses a significant risk to web application security. The flaw allows custom authentication headers to persist during cross-domain redirects, creating an opportunity for attackers to intercept sensitive credentials.
Security researchers identified that the library fails to properly sanitize authentication headers when redirecting between different domains. This oversight could enable malicious actors to capture API tokens, session cookies, and other authentication data that should remain confidential during redirect operations.
Organizations using Node.js applications that depend on follow-redirects should prioritize updating to the latest patched versions. The vulnerability represents a classic example of how seemingly minor implementation oversights can create serious security implications in modern web development.
Technical Impact
- Authentication headers fail to be stripped during cross-domain redirect scenarios
- Sensitive credentials including API keys and session tokens may be exposed
- Attackers can potentially capture header information through malicious redirect chains
- Vulnerability exists in the HTTP redirect handling logic of the library
Affected Systems and Recommendations
- All applications using vulnerable versions of follow-redirects npm package
- Node.js applications that handle HTTP redirects with custom authentication headers
- Frameworks and tools that depend on follow-redirects as a sub-dependency
- Developers should audit dependencies and update to patched versions immediately
- Consider implementing additional header sanitization as a defensive measure
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.