GHSA-cxjh-pqwp-8mfp follow-redirects' Proxy-Authorization header kept across hosts

• npm follow-redirects: < 1.15.6 → fixed in 1.15.6

When using axios, its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too. Steps To Reproduce & PoC Test code: ```js const axios = require('axios'); axios.get('http://127.0.0.1:10081/', { headers: { 'AuThorization': 'Rear Test', 'ProXy-AuthoriZation': 'Rear Test', 'coOkie': 't=1' } }) .then((response) => { console.log(response); }) ``` When I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept. Impact This vulnerability may lead to credentials leak. Recommendations Remove proxy-authentication header during cross-domain redirect Recommended Patch follow-redirects/index.js:464 ```diff • removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers); + removeMatchingHeaders(/^(?:authorization|proxy-authorization|cookie)$/i, this._options.headers); ```