IT SBIT Services
Schneeberger
DEEN
CVE tracker

follow-redirects: Credential leak on redirect with array-form headers

CVE-2026-111756High 8.2

← All vulnerabilities

Summary

follow-redirects, a Node.js HTTP and HTTPS client library that follows redirects automatically, does not strip credential headers when an application passes headers as an array. An attacker-controlled server that the application contacts can answer with a cross-origin redirect and receive the Authorization, Cookie and Proxy-Authorization headers unchanged. No authentication is required, but the application must use array-form headers and follow redirects to untrusted hosts.

Affected

  • follow-redirects 1.16.0 up to but not including 1.16.1
  • Applications that pass headers as an array and follow redirects

Fixed in

  • Fixed in 1.16.1
  • Version 1.16.2 also fixes the related CVE-2026-116689 (cross-realm sensitiveHeaders arrays)

Workaround

  • Use plain-object headers in application code
  • Disable automatic redirects for calls to third-party or untrusted endpoints
  • No vendor workaround is documented; upgrading is the recommended fix

Exploitation

  • CISA SSVC lists exploitation as PoC and automatable as no
  • No in-the-wild exploitation known
  • Exposure depends on the application code, so the risk is lower than the CVSS score suggests

Our recommendation

  • Run npm ls follow-redirects on all Node.js projects and update to 1.16.2 or later
  • Check whether code passes headers as arrays and whether outbound calls with credentials can be redirected to third-party hosts
  • Monitor outbound traffic from backend services that call external APIs with tokens or cookies

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:34.

Original description (NVD)

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices "0", "1", "2" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed