Incorrect Regular Expression Affecting follow-redirects package, versions >=1.16.0 <1.16.1

Affected versions of this package are vulnerable to Incorrect Regular Expression in the escapeRegex function in index.js, which escapes ], \, /, (, ), *, +, ?, ., and $ but leaves ^, |, [, {, and } intact, and whose output is joined into the alternation that the RedirectableRequest constructor compiles into this._headerFilter. An attacker can receive a custom credential header that the application declared through sensitiveHeaders by drawing the request into a cross-origin redirect to a host they control, because a declared name holding ^, such as X-Api^Key, gains a mid-pattern start-of-string anchor and can never match, while one holding |, such as X-Token|Secret, splits into the separate alternatives X-Token and Secret, so the real header is forwarded and unrelated headers by those names are stripped instead. Only ^ and | are reachable in practice, since Node rejects [, {, and } in header names with ERR_INVALID_HTTP_TOKEN and declaring one of them instead throws a SyntaxError from the constructor, and the built-in Authorization, Proxy-Authorization, and Cookie entries contain no metacharacters, so the failure is confined to applications that declare their own names and silently lose the protection they configured.

• GitHub Advisory
• GitHub Commit
• GitHub Release