CVE-2026-111756: follow-redirects Package Vulnerability Leading to Credential Leakage

Background

The follow-redirects package is a widely used Node.js library that simplifies the handling of HTTP redirects. It acts as a drop-in replacement for Node's native http.request, allowing developers to manage redirects seamlessly while maintaining control over HTTP headers. However, this package has a critical vulnerability that can lead to the unintended exposure of sensitive credential headers when following cross-origin redirects.

Vulnerability Detail

The vulnerability arises from the way follow-redirects handles HTTP headers, specifically when they are passed in an array format. The library is designed to strip sensitive headers such as Authorization, Proxy-Authorization, and Cookie when following redirects to different hosts or downgrading protocols. However, due to the use of a for...in loop, the removal routine fails to match header names when headers are provided as an array. As a result, sensitive headers are forwarded to potentially malicious destinations without any warning, leading to unauthorized access to user credentials. This issue is classified as an unauthenticated confidentiality vulnerability, allowing attackers to harvest sensitive information without requiring user interaction.

npm install follow-redirects@1.16.1

Workaround

As a temporary workaround, developers can avoid using array-form headers when making requests with the follow-redirects package. Instead, use an object to define headers, which will ensure that the sensitive headers are stripped correctly. For example:

const followRedirects = require('./index.js');
const http = require('http');

followRedirects.http.request({
  hostname: 'example.com',
  path: '/',
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_TOKEN',
    'Cookie': 'session=YOUR_SESSION_ID'
  }
}, function (res) {
  // Handle response
}).end();

Conclusion

The CVE-2026-111756 vulnerability in the follow-redirects package poses a significant risk by allowing sensitive credential headers to be leaked during cross-origin redirects. It is crucial for developers to update to the patched version and avoid using array-form headers to protect user credentials.

See every vulnerability recorded for follow-redirects →

FAQ