Read the docs
TI-2026-76983 Aliases CVE-2026-111756GHSA-q3jh-wrc6-jgq8

Credential headers leak across redirects in follow-redirects

Priority HIGH 69CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

follow-redirects from 1.16.0 before 1.16.1 is affected. When an application passes headers as an alternating array, the header removal routine iterates with for...in, which yields numeric indices instead of header names, so Authorization, Cookie and Proxy-Authorization headers are not stripped before a cross-origin redirect (CWE-212). An unauthenticated remote server that the victim application contacts can respond with a cross-origin redirect to collect these credential headers.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices "0", "1", "2" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00471 40th percentileScored 2026-11-07
Fix Partial follow-redirects (follow-redirects): 1.16.1follow-redirects (npm): 1.16.1Red Hat: 3 advisoriesRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
follow-redirectsfollow-redirects1.16.0 to before 1.16.11.16.1Patch availableCNA
—follow-redirects (npm)1.16.0 to before 1.16.11.16.1Patch availableGHSA-q3jh-wrc6-jgq8
  • follow-redirects Vendorfollow-redirects Affected 1.16.0 to before 1.16.1 Fixed in 1.16.1 Patch available CNA
  • follow-redirects (npm) Vendor— Affected 1.16.0 to before 1.16.1 Fixed in 1.16.1 Patch available GHSA-q3jh-wrc6-jgq8

Remediation

Upgrade follow-redirects to version 1.16.1 or later, which fixes the npm package. Red Hat fixes Red Hat Hardened Images with RHSA-2026:88541, RHSA-2026:88537 and RHSA-2026:88478.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA follow-redirects (follow-redirects) Fixed in 1.16.1
  • Fix · GHSA-q3jh-wrc6-jgq8 follow-redirects (npm) Fixed in 1.16.1 Advisory →

Red Hat 3 advisories

  • RHSA-2026:88541 Released 2026-10-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.4-0.3.hum1@aarch64, grafana13.2-13.2.4-0.3.hum1@s390x, grafana13.2-13.2.4-0.3.hum1@src +1
  • RHSA-2026:88537 Released 2026-10-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.8-0.4.hum1@aarch64, grafana13.1-13.1.8-0.4.hum1@s390x, grafana13.1-13.1.8-0.4.hum1@src +1
  • RHSA-2026:88478 Released 2026-10-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.13-0.3.hum1@aarch64, grafana12.4-12.4.13-0.3.hum1@src, grafana12.4-12.4.13-0.3.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat Hardened ImagesFixed RHSA-2026:88478, RHSA-2026:88537, RHSA-2026:88541
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-111756
  2. 2026-10-21 Alias added: GHSA-q3jh-wrc6-jgq8
  3. 2026-10-21 Fix available: npm/[email protected] · GHSA-q3jh-wrc6-jgq8
  4. 2026-10-21 CVSS score added · GHSA-q3jh-wrc6-jgq8
  5. 2026-10-21 Weakness changed · GHSA-q3jh-wrc6-jgq8
  6. 2026-10-21 4 new references · GHSA-q3jh-wrc6-jgq8
  7. 2026-10-21 Affected versions changed · Red Hat
  8. 2026-10-21 CVSS score added · Red Hat
  9. 2026-10-22 Priority changed: MEDIUM → LOW
  10. 2026-10-23 CISA SSVC decision points changed
  11. 2026-10-23 Priority changed: LOW → HIGH
  12. 2026-10-23 Fix available: RHSA-2026:88541 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:88478 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:88537 · Red Hat
  15. 2026-10-23 Fix available: Red Hat Hardened Images · Red Hat

References

Other 4

  • TI-2026-76533 Regex escaping flaw in follow-redirects leaks credential headers CVSS 4.0HIGH 8.2
  • TI-2023-11383 Improper input validation in follow-redirects CVSS 3.1HIGH 7.3
  • TI-2024-19051 Proxy-Authorization header kept across hosts in follow-redirects CVSS 3.1MEDIUM 6.5
  • TI-2026-81522 Credential headers forwarded on redirects in follow-redirects CVSS 3.1MEDIUM 5.9
  • TI-2022-00097 Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects CVSS 3.1MEDIUM 6.5
  • TI-2026-29551 follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets CVSS 4.0MEDIUM 6.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences