Avaq

**Name of the Vulnerable Software and Affected Versions** Fluture-Node versions 4.0.0 through 4.0.1 **Description** Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into Fluture-Node, paired with a request that includes confidential headers such as `Authorization` or `Cookie`, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over unencrypted HTTP, the headers would be included in the follow-up request and be exposed to the third party, or potential http traffic sniffing. **Recommendations** For versions 4.0.0 and 4.0.1, use a custom redirection strategy via the `followRedirectsWith` function as a temporary workaround, based on the new strategies available in Fluture-Node@4.0.2. Update to version 4.0.2, which automatically redacts confidential headers when a redirect is followed across to another origin.