StackPrism

npm package

follow-redirects vulnerabilities by version

The latest release, 1.16.1 (Oct 1, 2026), has no known vulnerabilities. 26% of last week’s 110.4M downloads went to versions with known vulnerabilities. OSV.dev lists 5 advisories for follow-redirects; the newest was published on Apr 14, 2026.

npm (opens in a new tab) describes it as “HTTP and HTTPS modules that follow redirects.”

Latest release
1.16.1
Oct 1, 2026, no known vulnerabilities
Downloads last week
110.4M
All versions, from npm
Advisories on OSV.dev
5
Newest Apr 14, 2026
Licence
MIT
OpenSSF Scorecard
4.6/10
follow-redirects/follow-redirects (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
1.16.0Apr 13, 2026No known vulnerabilities55M
1.16.1latestOct 1, 2026No known vulnerabilities26.8M
1.15.11Jul 31, 20251 known vulnerability, worst rated warning13.4M
1.15.9Sep 6, 20241 known vulnerability, worst rated warning5M
1.15.6Mar 14, 20241 known vulnerability, worst rated warning3M
1.15.2Sep 13, 20223 known vulnerabilities, worst rated warning1.7M
1.5.10Nov 19, 20185 known vulnerabilities, worst rated critical1.3M
1.15.3Sep 19, 20233 known vulnerabilities, worst rated warning496.1K

Who is still on a vulnerable follow-redirects

26% of last week’s 110.4M follow-redirects downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. follow-redirects doesn’t publish support dates we can check.

LineNewest releaseReleased
11.16.1Oct 1, 2026
0.30.3.0Oct 20, 2016
0.20.2.0Jun 6, 2016
0.10.1.0Apr 10, 2016
0.00.0.7Sep 10, 2015

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-40895 on OSV.dev (opens in a new tab)GHSA-r4q5-vmmm-2653

    follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

    Affects < 1.16.0. Published Apr 14, 2026.

  2. WarningCVE-2024-28849 on OSV.dev (opens in a new tab)GHSA-cxjh-pqwp-8mfp

    follow-redirects' Proxy-Authorization header kept across hosts

    Affects < 1.15.6. Published Mar 14, 2024.

  3. WarningCVE-2023-26159 on OSV.dev (opens in a new tab)GHSA-jchw-25xp-jwwc

    Follow Redirects improperly handles URLs in the url.parse() function

    Affects < 1.15.4. Published Jan 2, 2024.

  4. WarningCVE-2022-0536 on OSV.dev (opens in a new tab)GHSA-pw2r-vq6v-hr8c

    Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects

    Affects < 1.14.8. Published Feb 10, 2022.

  5. CriticalCVE-2022-0155 on OSV.dev (opens in a new tab)GHSA-74fj-2j2h-c42q

    Exposure of sensitive information in follow-redirects

    Affects < 1.14.7. Published Jan 12, 2022.

Which follow-redirects do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for follow-redirects, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.