follow-redirects sensitiveHeaders regex escaping can expose credential headers

影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1 Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each through escapeRegex. escapeRegex escapes only a partial set of metacharacters and leave…

GitHub Advisory Databaseで読む