follow-redirects, a Node.js HTTP client wrapper, incorrectly handles array-form headers when following cross‑origin redirects. The code assumes headers are a plain object, so when headers are supplied as an alternating array, the filtering logic never removes sensitive headers. Consequently, an attacker controlling the redirect target can retrieve Authorization, Cookie, and Proxy‑Authorization headers sent by the application. The vulnerability allows any remote server that the application contacts to capture these credentials by issuing a cross‑origin redirect, representing an unauthenticated confidentiality breach.

Vulnerable versions of the library are those from 1.16.0 up to but not including 1.16.1. All applications that depend on follow‑redirects 1.16.0 or earlier and that send headers in array form are at risk. The patch introducing proper handling of array-form headers was released in version 1.16.1, so any installation later than that version is no longer vulnerable.

The CVSS score of 8.2 indicates a high severity. No EPSS score is currently available, and the issue is not listed in CISA's KEV catalog, suggesting limited exploitation in the wild. However, the attack requires only a malicious redirect response, a condition that an attacker can trivially satisfy once their server is reachable by the vulnerable application. Because the leaked data includes authentication credentials, the potential impact on confidentiality is significant.