CVE-2026-111756
HighSummary
The follow-redirects library removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The description points to an issue in the header-removal routine, which iterates over the caller-provided structure.
Risk Assessment
A flaw in the header-removal mechanism may leak credentials (tokens, session cookies) to a different host or over an insecure channel. This can lead to session hijacking or unauthorized access to protected resources.
Recommendation
Update follow-redirects to a version containing the fix and verify that the application correctly declares sensitive headers. Consider restricting automatic redirect following to trusted hosts.
Other vulnerabilities in follow-redirects
See all- CVE-2026-111755High
follow-redirects versions 1.16.0 through 1.16.1 fail to escape regex metacharacters (^ or |) in sensitive header names. As a result, on cross-origin or HTTPS-to-HTTP redirects, the generated filter does not match the declared header and the credential header is forwarded to an attacker-controlled redirect target. The issue is fixed in version 1.16.1.
- CVE-2026-40895High
In the follow-redirects library for Node.js, a vulnerability was found where custom authentication headers (e.g., X-API-Key, X-Auth-Token) are not stripped during cross-domain redirects. An attacker could exploit this to intercept sensitive credentials.
Original NVD description (English source)
### Summary follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared `sensitiveHeaders`) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's h
Vulnerability data from NVD (NIST) · CISA KEV · EPSS