Prior to version 1.16.0, the follow-redirects library forwarded custom authentication headers such as X-API-Key or X-Auth-Token when following cross‑domain redirects (301/302/307/308). These headers were not stripped, allowing an attacker to capture the credentials that were intended for the original target. The primary impact is the unauthorized disclosure of authentication credentials, which could enable an attacker to gain elevated access to downstream services. The weakness is classified as CWE‑200.

Any Node.js application that uses the follow‑redirects package, version 1.15.x or earlier, is affected. The vulnerability is mitigated in releases 1.16.0 and later. Applications should verify the installed package version or upgrade to the current release to remove the behavior.

The CVSS score of 6.9 indicates a medium severity risk. Because the exploit requires only an HTTP request that triggers a cross‑domain redirect, it is relatively easy to execute from remote or local code that uses the library. The EPSS score is not available, but the lack of listing in the CISA KEV catalog suggests no widespread active exploits have been observed yet. Nevertheless, the potential for credential leakage makes it prudent to address promptly, especially in environments that expose sensitive API keys or tokens.