Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111756— follow-redirects array-form headers bypass cross-origin credential stripping

Quick assessment

Affected
follow-redirects follow-redirects
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

follow-redirects 是一个用于 Node.js 的 HTTP 和 HTTPS 客户端包装器，能够自动跟随重定向。在版本 1.16.0 至 1.16.1（不含）之间，当跟随跨主机重定向或降级到安全性较低的协议时，follow-redirects 会移除敏感凭证头（包括 Authorization、Proxy-Authorization、Cookie，以及调用者声明的 sensitiveHeaders）。其移除逻辑通过 for...in 循环遍历调用者的头信息容器，并将头名称与过滤规则进行匹配。该逻辑假设

CVSS 8.2 · High

Possible ATT&CK Techniques 2 AI

T1043 T1586 · Compromise Accounts

Affected Version Matrix 1

VendorProduct Version RangeStatus
follow-redirects follow-redirects >= 1.16.0, < 1.16.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111756

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
follow-redirects array-form headers bypass cross-origin credential stripping
Source: CVE Program / CVE List V5
Vulnerability Description
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices "0", "1", "2" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
follow-redirects follow-redirects >= 1.16.0, < 1.16.1 -

II. Public POCs for CVE-2026-111756

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111756

请登录查看更多情报信息。

Vendor Pages for CVE-2026-111756 (1)

Other References for CVE-2026-111756 (2)

IV. Related Vulnerabilities

Same product: follow-redirects
Same vendor: follow-redirects
Same weakness: CWE-200

V. Comments for CVE-2026-111756

No comments yet

Leave a comment