Prior to version 1.16.0, the follow-redirects library forwarded any custom authentication headers, such as X-API-Key or X-Auth-Token, when an HTTP request was automatically redirected across domain boundaries. This behavior allowed the original credentials to be transmitted to a third‑party site. The vulnerability is an information‑exposure flaw that could enable an attacker to discover values that were intended for a different service domain. The weakness is mapped to CWE-200 (Information Exposure) and CWE-212 (Missing Encryption of Credentials).

Any Node.js application that imports the follow-redirects package with a version earlier than 1.16.0 is affected. The package was updated in 1.16.0 to remove the forwarding of custom authentication headers on cross‑domain redirects. Applications should verify the installed package version or upgrade to the latest release to prevent the unintended leakage.

The CVSS score of 6.9 classifies this vulnerability as medium severity. The EPSS score of < 1% indicates a very low statistical probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an HTTP request that triggers a cross‑domain redirect, which can potentially be crafted by an attacker who can influence the URL requested by the application or by an attacker who can run code that uses the library. Based on the description, exploitation is relatively straightforward for code that can cause such redirects, but it requires the attacker to be able to influence or substitute the request URL.