npm follow-redirects 1.16.1 fixes credential leak in array header handling

The npm follow-redirects package contains a high-severity confidentiality flaw that exposes sensitive credentials during cross-origin redirects. Applications using versions 1.16.0 through 1.16.0.99 are vulnerable if they pass HTTP headers as alternating name-value arrays rather than plain objects. This configuration causes the library to fail to strip authorization and cookie headers before following redirects to external hosts.

Root cause

The vulnerability arises from how the library processes header containers. The removal routine uses a `for...in` loop to iterate through headers and match them against a filter for sensitive data. This approach assumes the headers container is a standard object keyed by string names. However, Node.js allows headers to be passed as an alternating array of names and values. When the library iterates over an array, it yields numeric indices like "0" and "1" instead of header names. These numeric indices never match the string-based filter, so no headers are removed.

Attack path

An attacker controls a remote server that the victim application contacts. When the victim sends a request with array-formatted headers containing credentials, the attacker responds with a cross-origin redirect. Because the follow-redirects library fails to strip sensitive headers in this scenario, it forwards the Authorization, Proxy-Authorization, and Cookie headers to the attacker's destination. This occurs without any error or warning to the application. The sensitiveHeaders option, added to address a previous issue, is equally ineffective here because it relies on the same flawed helper function.

Affected versions

• follow-redirects version 1.16.0 is vulnerable
• All versions up to 1.16.0.99 are vulnerable
• Version 1.16.1 patches the vulnerability
• Versions prior to 1.16.0 are not affected by this specific flaw

Mitigation

• Update follow-redirects to version 1.16.1 or later immediately
• Audit codebases for uses of array-formatted headers in HTTP requests
• Verify that all dependent projects have updated their package locks
• Monitor for any downstream packages that bundle vulnerable versions

Signals worth monitoring

Teams usually detect this activity by reviewing outbound traffic logs for unexpected cross-origin redirects. Check whether sensitive headers appear in requests to external domains that should not receive them. Look for anomalies in authentication token usage or session cookies being sent to untrusted hosts. First containment moves include isolating affected services and reviewing proxy logs for credential exfiltration patterns. Ensure monitoring tools capture full request headers to identify these leaks effectively.

What to do and how to stay safe: follow-redirects

• Scan your npm dependencies for follow-redirects versions below 1.16.1
• Review application code for instances where headers are passed as arrays
• Implement logging to capture full HTTP request headers for audit purposes
• Once the vendor provides an update, apply it to all production environments

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-111756?

The NVD rates CVE-2026-111756 with a CVSS score of 8.2, which is classified as high severity.

Does this vulnerability affect all uses of follow-redirects?

No, it only affects applications that pass HTTP headers as alternating name-value arrays rather than plain objects.

Is there a fix available for this vulnerability?

Yes, the issue has been patched in version 1.16.1 of the follow-redirects package.