Skip to content

[Aikido] Fix security issue in follow-redirects via minor version upgrade from 1.15.11 to 1.16.0#1651

Open
aikido-autofix[bot] wants to merge 2 commits intomainfrom
fix/aikido-security-update-packages-23269374-vtjs
Open

[Aikido] Fix security issue in follow-redirects via minor version upgrade from 1.15.11 to 1.16.0#1651
aikido-autofix[bot] wants to merge 2 commits intomainfrom
fix/aikido-security-update-packages-23269374-vtjs

Conversation

@aikido-autofix
Copy link
Copy Markdown
Contributor

Upgrade follow-redirects to fix credential leakage vulnerability where custom authentication headers leak on cross-domain redirects.

⚠️ Breaking changes analysis not available for: follow-redirects

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
GHSA-r4q5-vmmm-2653
MEDIUM
[follow-redirects] Custom authentication headers (e.g., X-API-Key, X-Auth-Token) are leaked to redirect targets on cross-domain redirects because only standard headers are stripped. This enables attackers to capture sensitive credentials through malicious redirects.

@aikido-autofix aikido-autofix Bot requested a review from a team as a code owner April 14, 2026 22:46
Comment thread yarn.lock
"@esbuild/win32-arm64": "npm:0.28.0"
"@esbuild/win32-ia32": "npm:0.28.0"
"@esbuild/win32-x64": "npm:0.28.0"
"esbuild@npm:0.25.0":
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it trying to downgrade this package?

@tmthrgd-aligent
Copy link
Copy Markdown

This update literally fixes nothing at all. follow-redirects@1.16.0 merely introduces an option that can change the behaviour of header removal on redirect. The default behaviour is identical to follow-redirects@1.15.11. See follow-redirects/follow-redirects@844c4d302ac963d29bdb5dc1754ec7df3d70d7f9.

If this is a vulnerability, and I'm not convinced that it is, then this change doesn't fix it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant