npm follow-redirects CVE-2026-111756: Cross-origin redirect flaw steals auth tokens via array headers

The npm follow-redirects package contained a high-severity flaw that exposed sensitive headers during cross-origin redirects. Applications using array-form headers were vulnerable to credential theft.

What happened

The follow-redirects library, which serves as a drop-in replacement for Node.js http.request, is designed to strip sensitive headers like Authorization and Cookie before following redirects to different hosts or less secure protocols. According to the GitHub advisory GHSA-q3jh-wrc6-jgq8, the removal routine failed when headers were provided as an alternating array of names and values.

The code used a for...in loop to iterate over the headers container, assuming it was a plain object keyed by header names. When the container was an array, the loop yielded numeric indices such as "0" and "1" instead of header names. These indices never matched the filter for sensitive headers, so nothing was removed.

Consequently, an application sending array-form headers would forward its Authorization, Cookie, and Proxy-Authorization headers verbatim to an attacker-controlled destination upon receiving a cross-origin redirect. This occurred without any error or warning to the application. The sensitiveHeaders option, added to address CVE-2026-40895, was equally ineffective because it relied on the same flawed helper function.

Why it matters

This unauthenticated confidentiality vulnerability allows any remote server contacted by the victim application to harvest credential headers. An attacker simply needs to respond with a cross-origin redirect to trigger the leak. The issue affects all versions from 1.16.0 up to, but not including, 1.16.1.

The NVD record assigns a CVSS score of 8.2 to CVE-2026-111756, classifying it as high severity. The weakness is linked to CWE-200 and CWE-212. Because the library is a common wrapper for HTTP clients, many Node.js applications may be exposed if they use array-style header definitions.

Next steps

• Update the follow-redirects package to version 1.16.1 immediately.
• Audit applications for usage of array-form headers in HTTP requests.
• Review logs for unexpected cross-origin redirects from internal services.
• Verify that sensitiveHeaders options are not being relied upon for security.

Detection notes

Security teams should monitor web proxy logs and server access records for outbound requests containing authorization or cookie headers that cross domain boundaries. Look for HTTP responses with redirect status codes followed by requests to external hosts that include sensitive tokens. Check whether internal services are initiating connections to unknown external endpoints after receiving redirects. Containment usually involves isolating affected services and rotating any credentials that may have been transmitted to untrusted destinations during the exposure window.

What to do and how to stay safe

• Upgrade to follow-redirects version 1.16.1 once the vendor provides the update.
• Inspect application code for instances where headers are passed as arrays to HTTP clients.
• Monitor network traffic for outbound requests carrying authentication headers to unexpected domains.
• Implement strict redirect policies that prevent following cross-origin redirects with sensitive data.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.