follow-redirects array-form headers bypass cross-origin credential stripping (High severity, CVE-2026-111756)
A high-severity advisory for the npm package follow-redirects is fixed in version 1.16.1.
Key points
- follow-redirects (npm) has a high flaw.
- Tracked as CVE-2026-111756.
- Version 1.16.1.
Maintainers of follow-redirects, a package in the npm ecosystem, have published a high-severity security advisory (CVE-2026-111756): follow-redirects array-form headers bypass cross-origin credential stripping.
At a glance
- Advisory
- GHSA-q3jh-wrc6-jgq8
- CVE
- CVE-2026-111756
- Package
- follow-redirects (npm)
- Severity
- High
- Patched in
- 1.16.1
What is the issue?
The GitHub-reviewed advisory explains: Summary follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices "0", "1", "2" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authoriza
Affected versions
| Ecosystem | Package | Vulnerable | Patched |
|---|---|---|---|
| npm | follow-redirects | >= 1.16.0, < 1.16.1 | 1.16.1 |
How to fix it
- Upgrade the affected package to the first patched version listed above.
- Rebuild and redeploy applications that bundle the vulnerable dependency.
- Run your dependency scanner (npm audit, pip-audit, Dependabot) to find transitive uses.
- Review the advisory references for workaround details if you cannot upgrade yet.
What to do and how to stay safe: CVE-2026-111756
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-111756?
CVE-2026-111756 is a security vulnerability in follow-redirects (npm).
Which version fixes CVE-2026-111756?
The fix is in version 1.16.1.
