CPE
The follow-redirects library fails to strip sensitive headers when provided in array format, leading to the unauthorized disclosure of credentials during cross-origin or protocol-downgrade redirects.