CVE-2026-111756 is a vulnerability in the follow-redirects package that allows sensitive credential headers to be forwarded verbatim to an attacker-controlled destination when following a cross-origin redirect. This occurs when the headers are passed in an array form, which bypasses the removal routine for sensitive headers. The vulnerability exists because the package incorrectly handles array-form heade [truncated]
The follow-redirects library's sensitiveHeaders option is vulnerable to regex escaping issues, potentially exposing custom credential headers during cross-origin redirects. This vulnerability arises from incomplete metacharacter escaping in the library's implementation of the sensitiveHeaders option, which can lead to silent exposure of sensitive headers. Defenders should prioritize verifying and updating [truncated]
