Key points
- Versions 1.16.0 and below are vulnerable to CVE-2026-111756.
- Version 1.16.1 patches the high-severity credential stripping flaw.
- The issue affects applications using array-form headers with Node.js http.request.
The follow-redirects npm package, widely used as a drop-in replacement for Node.js http.request, contains a high-severity vulnerability identified as CVE-2026-111756. According to GitHub advisory GHSA-q3jh-wrc6-jgq8, versions greater than or equal to 1.16.0 and less than 1.16.1 are affected. A patch has been released in version 1.16.1. This update resolves an issue where sensitive credential headers are not removed when following redirects to different hosts or less secure protocols.
In plain English
The follow-redirects package is designed to protect user credentials by stripping sensitive headers like Authorization, Proxy-Authorization, and Cookie before following a redirect to a different website or a less secure connection. This protection fails when applications pass headers as an alternating array of names and values, a format supported by the underlying Node.js http.request module. The package’s internal logic assumes headers are stored as a plain object with named keys. When it processes an array, it iterates through numeric indices instead of header names, causing the filtering mechanism to miss all sensitive data entirely.
The background
This vulnerability stems from how the package implements its cross-origin credential-stripping control. The function responsible for removing sensitive headers uses a loop that expects object keys. When given an array, the loop yields numeric strings like "0" or "1" rather than header names. These numeric indices never match the filter rules designed to catch sensitive header names. Consequently, the package forwards the original headers verbatim to the destination server. This flaw also renders the sensitiveHeaders option, added to address a previous issue, equally ineffective because it relies on the same broken helper function.
What changes now
Applications using follow-redirects version 1.16.0 or earlier are exposed to unauthenticated confidentiality breaches. Any remote server that a victim application contacts can harvest credential headers by responding with a cross-origin redirect. The attacker receives the Authorization, Cookie, and Proxy-Authorization headers without triggering any error or warning in the victim application. This allows remote servers to capture sensitive authentication data silently. The vulnerability exists regardless of whether the application explicitly configures the sensitiveHeaders option, as the underlying removal routine fails for array-based header inputs.
Who needs to act first
Teams should prioritize updating systems that interact with external services or third-party APIs, as these are most likely to encounter cross-origin redirects. Before rolling out the patch, verify that the updated package works correctly with existing application logic, especially if custom header formats are used. Back up current configurations and dependencies to allow for quick rollback if compatibility issues arise. Monitor application logs for unusual redirect patterns or authentication failures after the update. Ensure that development and staging environments are patched before moving changes to production servers.
What to do and how to stay safe: follow-redirects
- Update the follow-redirects package to version 1.16.1 or later in all affected projects.
- Audit application code to identify instances where headers are passed as arrays to http.request.
- Review server logs for unexpected cross-origin redirect responses that may indicate exploitation.
- Monitor vendor channels for further updates regarding related vulnerabilities in dependency chains.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of follow-redirects are vulnerable?
Versions greater than or equal to 1.16.0 and less than 1.16.1 are vulnerable to this credential leak.
Is there a fix available for CVE-2026-111756?
Yes, version 1.16.1 of the follow-redirects package patches this high-severity vulnerability.
How does an attacker exploit this flaw?
An attacker controls a remote server that responds with a cross-origin redirect, causing the victim application to forward sensitive headers verbatim.
