Security incident · CVE-2026-111756

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects.

Published Oct 20, 2026 · catalog updated Oct 24, 2026 · follow-redirects is a Node.js

Last checked Oct 31, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-111756. EPSS is 0.47%. Act only if a listed version of follow-redirects is a Node.js is installed.

Gaps on this record

The stored product name is a package slug. The name on this page is taken from the title (follow-redirects is a Node.js).
No vendor fix or required action is stored. Compare the linked advisory before you change production.

Severity: High8.2
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.47%
Remediation: Advisory link
Affected products: Debian:12 node-follow-redirects · Debian:13 node-follow-redirects · Debian:14 node-follow-redirects · npm follow-redirects

### Summary follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared ) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying , which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, yields the numeric indices , , and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. ### Details The cross-origin credential-stripping control is implemented by at : It is invoked from for three purposes, all with the caller-supplied : - - strip the credential filter ( , which covers the built-in list Authorization/Proxy-Authorization/Cookie plus any ) when the redirect crosses origin or downgrades protocol. - - strip the header ( ). - - strip headers when a 301/302/303 converts POST to GET. The caller-supplied headers container is passed straight through to each redirected request via at . (index.js:300-331) only replaces when it is falsy, so an array is left untouched. Node's accepts as an alternating array of names and values (for example ). This is a supported way to control header ordering and duplication. For suc

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

Debian:12 node-follow-redirects1.15.11+~1.14.4-1, 1.15.11+~1.14.4-2, 1.15.2+~1.14.1-1
Debian:13 node-follow-redirects1.15.11+~1.14.4-1, 1.15.11+~1.14.4-2, 1.15.9+~1.14.4-1
Debian:14 node-follow-redirects1.15.11+~1.14.4-1, 1.15.11+~1.14.4-2, 1.15.9+~1.14.4-1
npm follow-redirects1.16.0 → 1.16.1

How to fix CVE-2026-111756

Upgrade
CVE-2026-111756 lists a fix boundary at 1.16.1. Compare the installed build with that boundary before you change production.
Version check
Seen in 1.15.11+~1.14.4-1 · 9 other packages on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-111756. EPSS is 0.47%. Act only if a listed version of follow-redirects is a Node.js is installed.

Which versions are affected?

Compare what you have installed with 1.15.11+~1.14.4-1, 1.15.11+~1.14.4-2, 1.15.2+~1.14.1-1, 1.15.11+~1.14.4-1, 1.15.11+~1.14.4-2, 1.15.9+~1.14.4-1, 1.16.0 → 1.16.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-200: Exposure of Sensitive Information; CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer. EPSS 0.47%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Oct 20, 2026 · GitHub Advisory Database
Fix available
follow-redirects fixed in 1.16.1
Oct 20, 2026 · NIST NVD
Detected
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal r
Oct 20, 2026 · GitHub Advisory Database
Fix available
follow-redirects fixed in 1.16.1
Oct 20, 2026 · NIST NVD
Updated
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal r
Oct 23, 2026 · NIST NVD
Updated
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal r
Oct 24, 2026 · Trivy Vulnerability DB
Updated
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal r

Sources

CVE.orgVulnerability recordCVE-2026-111756
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-111756
30-day exploitation probability 0.47%
first.org
GitHub Advisory DatabasePackage advisoryGHSA-q3jh-wrc6-jgq8
GitHub Advisory Database record mirrored by OSV.
github.com
NIST NVDVulnerability recordCVE-2026-111756
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHead
nvd.nist.gov
OpenSSF OSV / OSV ScannerPackage advisoryGHSA-q3jh-wrc6-jgq8
follow-redirects array-form headers bypass cross-origin credential stripping
osv.dev
Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-111756
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHead
osv.dev
urlscan.ioThreat intelligenceCVE-2026-111756
urlscan.io

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

FIRST EPSSOct 31, 2026
urlscan.ioOct 31, 2026
Trivy Vulnerability DBOct 24, 2026
NIST NVDOct 23, 2026
CVE.orgOct 21, 2026
GitHub Advisory DatabaseOct 20, 2026
OpenSSF OSV / OSV ScannerOct 20, 2026

Priority score

24/100

Evidence confidence: High

Several independent sources name this vulnerability.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity12/15
Public exploit0/10
Internet exposure6/10
Product prevalence5/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

High

CVSS severity
8.2 v4.0
Technical impact. Separate from exploitation likelihood.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:
EPSS probability
0.47% · p40.48%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Advisory link
A patch or advisory reference is linked. Open the original publisher for availability by product version.

Stacks

Debian Debian 12 Debian 13 Debian 14 Linux Node.js npm

Weakness

CWE-200
Exposure of Sensitive Information
MITRE definition
CWE-212
Improper Removal of Sensitive Information Before Storage or Transfer
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.