GHSA-r4q5-vmmm-2653: follow-redirects fixed in 1.16.0

GHSA-r4q5-vmmm-2653 PUBLISHED CVSS 5.300000190734863 MEDIUM

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

Record from GitHub Advisory Database · Published April 14, 2026

follow-redirects is fixed in 1.16.0 (npm)

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
follow-redirects	npm	1.16.0
kubeflow-pipelines	Wolfi	2.16.0-r15
argo-workflows-3.7	Chainguard	3.7.13-r2
argo-workflows-4.0	Chainguard	4.0.4-r5
gitlab-rails-ce-19.2	Chainguard	19.2.4-r4
langfuse-2	Chainguard	2.95.12-r19
kubeflow-katib	Wolfi	0.19.0-r40, 0.19.0-r31
configurable-http-proxy	Chainguard	5.2.0-r3
gitlab-rails-ce-fips-19.1	Chainguard	19.1.1-r1
saf	Chainguard	1.6.0-r0
nextcloud-server-33	Chainguard	33.0.6-r0
code-server	Wolfi	4.112.0-r3

43 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

5.300000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Vendor	Product	Versions
wolfi	kubeflow-pipelines	0
chainguard	argo-workflows-3.7	0

chainguard	argo-workflows-4.0	0
chainguard	gitlab-rails-ce-19.2	0
chainguard	langfuse-2	0
wolfi	kubeflow-katib	0, 0
chainguard	configurable-http-proxy	0
chainguard	gitlab-rails-ce-fips-19.1	0
chainguard	saf	0
chainguard	nextcloud-server-33	0
wolfi	code-server	0
wolfi	thingsboard	0
chainguard	gitlab-rails-ce-19.0	0
wolfi	saf	0
chainguard	prism	0
chainguard	kibana-8.19	0
chainguard	kibana-9.3	0
chainguard	gitlab-rails-ce-fips-18.11	0
chainguard	opensearch-dashboards-3	0

…and 37 more

Timeline

Apr 14, 2026 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-r4q5-vmmm-2653
vulnetix vdb fixes GHSA-r4q5-vmmm-2653

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-r4q5-vmmm-2653/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →