Skip to content

[Aikido] Fix 2 security issues in follow-redirects, axios#1657

Merged
TheOrangePuff merged 2 commits intomainfrom
fix/aikido-security-update-packages-24854505-inug
Apr 22, 2026
Merged

[Aikido] Fix 2 security issues in follow-redirects, axios#1657
TheOrangePuff merged 2 commits intomainfrom
fix/aikido-security-update-packages-24854505-inug

Conversation

@aikido-autofix
Copy link
Copy Markdown
Contributor

Upgrade follow-redirects and axios to fix credential leakage on cross-domain redirects and prototype pollution header injection vulnerabilities.

⚠️ Breaking changes analysis not available for: follow-redirects

✅ No breaking changes for: axios

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
GHSA-r4q5-vmmm-2653
MEDIUM
[follow-redirects] Custom authentication headers (e.g., X-API-Key, X-Auth-Token) are leaked to redirect targets on cross-domain redirects because only standard headers are stripped. This enables attackers to capture sensitive credentials through malicious redirects.
AIKIDO-2026-10509
MEDIUM
[axios] Prototype pollution vulnerability allows attackers to inject malicious headers into requests through unsafe FormData detection and header merging, potentially enabling authorization bypass or request manipulation.

@aikido-autofix aikido-autofix Bot requested a review from a team as a code owner April 21, 2026 22:45
@TheOrangePuff TheOrangePuff merged commit acfd6f1 into main Apr 22, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant