CVE-2026-111756 follow-redirects CVE debrief

Who should care

Defenders responsible for applications using the follow-redirects package, especially those sending array-form headers and following cross-origin redirects, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-111756 allows sensitive credential headers to be forwarded verbatim to an attacker-controlled destination when following a cross-origin redirect with array-form headers in the follow-redirects package. Defenders should prioritize verifying application configurations, assessing exposure, and updating to version 1.16.1 or later if vulnerable.

• Potential unauthorized access to sensitive credentials
• Possible elevation of privileges through cross-origin redirects
• Risk of sensitive data exposure in transit
• Need for verification of application configurations and header handling

Technical summary

The follow-redirects package removes sensitive credential headers before following a redirect that crosses to a different host or downgrades to a less secure protocol. However, when headers are passed in an array form, the removal routine does not work correctly, allowing sensitive headers to be forwarded verbatim to an attacker-controlled destination. This vulnerability arises from the package's incorrect handling of array-form headers in its redirect logic. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning.

Defensive priority

Defenders should prioritize verifying if their applications use the follow-redirects package and send array-form headers, and then assess exposure to cross-origin redirects.

Recommended defensive actions

• Verify if applications use the follow-redirects package and send array-form headers
• Assess exposure to cross-origin redirects
• Update to version 1.16.1 or later if vulnerable
• Monitor for unauthorized access to sensitive credentials
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in the follow-redirects package when used with Node's underlying http.request, which accepts headers as an alternating array of names and values. The removal routine for sensitive headers assumes a plain object keyed by header names and does not work correctly with array-form headers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.