follow-redirects, a Node.js HTTP and HTTPS client wrapper, contains a flaw where the escapeRegex function fails to escape regex metacharacters in the sensitiveHeaders list. When an application declares a header name that includes characters such as ^ or | and the request follows a cross‑origin or HTTPS‑to‑HTTP redirect, the generated filter does not match the header name and the credential header is forwarded to the attacker‑controlled redirect target. This unauthorized forwarding results in the disclosure of sensitive credentials that were intended to remain private.

Versions of follow-redirects from 1.16.0 through just before 1.16.1 are affected. Any Node.js application that uses this library to automatically follow redirects and declares a sensitive header whose name contains unescaped regex metacharacters is at risk. The vulnerable product is the follow‑redirects library commonly used in JavaScript/Node.js HTTP client code.

The vulnerability has a CVSS score of 8.2, signifying high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers can exploit this by directing traffic through a malicious redirect URL that receives the forwarded credential header. The impact is primarily the exposure of credential information; the attack does not require local code execution or elevated privileges on the target system, but it does rely on influencing or observing a redirect path. Therefore, the risk is significant, especially when sensitive headers contain unescaped characters exposed during redirects.