[GHSA-r4q5-vmmm-2653] follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

[ljharb]

Updates

• Affected products

Comments
Empirical POC-based runtime testing confirms follow-redirects 0.0.1-0.0.5 do not leak custom sensitive headers on cross-host redirects - same mechanism as GHSA-74fj-2j2h-c42q. The sensitiveHeaders option the advisory describes is a late addition, but the underlying cross-host header-forwarding behavior the leak depends on is what determines applicability, and that behavior was introduced in 0.0.6.

[github]

Hi there @RubenVerborgh! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Updates the affected version range for the follow-redirects advisory (GHSA-r4q5-vmmm-2653) to reflect that the vulnerable cross-host header-forwarding behavior begins at 0.0.6, aligning applicability with observed runtime behavior.

Changes:

• Update the affected range “introduced” version from 0 to 0.0.6.
• Bump the advisory modified timestamp accordingly.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[RubenVerborgh]

Honestly, I don't know… v0.0.6 was over 10 years ago, and before I got involved. I just hope no one still runs 0.x.

[helixplant]

Hi @ljharb,
Thank you for taking the time to share this information. While we appreciate the effort, we’re not able to assist with these requests at this time. Please contact the respective assigning CNA or the affected repository maintainers for each advisory so they can validate the lower bound versioning information and make any necessary updates. This guidance also applies to the following PRs:

• [GHSA-cxjh-pqwp-8mfp] follow-redirects' Proxy-Authorization header kept across hosts #7475
• [GHSA-jchw-25xp-jwwc] Follow Redirects improperly handles URLs in the url.parse() function #7474
• [GHSA-pw2r-vq6v-hr8c] Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects #7473
• [GHSA-74fj-2j2h-c42q] Exposure of sensitive information in follow-redirects #7472