Confidentiality Vulnerability in Follow-Redirects Node.js Client by Follow-Redirects

CVE-2026-111756

What is CVE-2026-111756?

A vulnerability in the Follow-Redirects Node.js client allows sensitive credential headers, such as Authorization, Proxy-Authorization, and Cookie, to be unintentionally forwarded to attacker-controlled destinations during cross-origin redirects. This occurs when applications using the follow-redirects module send headers in array format, leading to improper removal of these critical headers before redirecting. As a result, malicious servers can harvest sensitive credentials without alerting the victim application. The issue, previously unresolved, has since been patched in version 1.16.1.

References