Incorrect Regular Expression

Summary

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. In versions 1.16.0 prior to 1.16.1, `escapeRegex` leaves valid header-name metacharacters unescaped in `sensitiveHeaders`. When an application declares a sensitive header whose name contains `^` or `|` and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.