CVE-2026-111756
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability in follow-redirects (versions 1.16.0 to before 1.16.1) causes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, sensitiveHeaders) not to be stripped when following a cross-host or protocol-downgrade redirect if the application supplied headers as an alternating array of names and values. The removal routine uses for...in, which yields numeric indices for arrays, so no header name matches the filter and nothing is removed. As a result, the application forwards credentials to an attacker-controlled destination without any error or warning.
Risk Assessment
An attacker can harvest the victim's credential headers by responding with a cross-origin redirect, leading to session or credential theft and potential unauthorized access to protected resources.
Recommendation
Update follow-redirects to version 1.16.1 or later. Until patched, avoid passing headers in array form or implement custom header-stripping validation on redirects.
Other vulnerabilities in follow-redirects
See all- CVE-2026-116689Medium
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
- CVE-2026-111755High
follow-redirects versions 1.16.0 through 1.16.1 fail to escape regex metacharacters (^ or |) in sensitive header names. As a result, on cross-origin or HTTPS-to-HTTP redirects, the generated filter does not match the declared header and the credential header is forwarded to an attacker-controlled redirect target. The issue is fixed in version 1.16.1.
- CVE-2026-40895High
In the follow-redirects library for Node.js, a vulnerability was found where custom authentication headers (e.g., X-API-Key, X-Auth-Token) are not stripped during cross-domain redirects. An attacker could exploit this to intercept sensitive credentials.
Original NVD description (English source)
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices "0", "1", "2" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS