{"id":"EUVD-2026-105225","enisaUuid":"8cc20a6c-66e3-347d-b7b0-0df693ffd3a6","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller\u0027s headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node\u0027s underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim\u0027s credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.","datePublished":"Oct 20, 2026, 5:58:21 PM","dateUpdated":"Oct 23, 2026, 1:59:26 AM","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8\nhttps://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff\nhttps://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1\n","aliases":"CVE-2026-111756\nGHSA-q3jh-wrc6-jgq8\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"8d397ae8-09db-3da5-b098-65cf280536b0","product":{"name":"follow-redirects","vendor":{"name":"follow-redirects"}},"product_version":"1.16.0, \u003c 1.16.1"}],"enisaIdVendor":[{"id":"14b08204-d9c4-319c-b85e-30ffa7723718","vendor":{"name":"follow-redirects"}}],"enisaIdVulnerability":[{"id":"7ba39a9d-f252-31b2-8544-a8f805cc92b5","vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","description":"follow-redirects array-form headers bypass cross-origin credential stripping","datePublished":"Oct 20, 2026, 5:58:04 PM","dateUpdated":"Oct 20, 2026, 5:58:04 PM","baseScore":0.0,"references":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8\nhttps://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff\nhttps://github.com/follow-redirects/follow-redirects\nhttps://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1\n","enisa_id":"EUVD-2026-105225\n","aliases":"CVE-2026-111756\nGHSA-q3jh-wrc6-jgq8\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9aef4973-877c-34a2-9d4c-cbf3a0fc372a","vulnerability":{"id":"CVE-2026-111756","description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller\u0027s headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node\u0027s underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim\u0027s credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.","datePublished":"Oct 20, 2026, 5:58:21 PM","dateUpdated":"Oct 23, 2026, 1:59:26 AM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8\nhttps://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff\nhttps://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1\n","enisa_id":"EUVD-2026-105225\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Nov 4, 2026, 7:13:50 AM","vulnerabilityProduct":[{"id":"929c4f72-0970-3ba0-a609-7b84517f9694","product":{"name":"follow-redirects","vendor":{"name":"follow-redirects"}},"product_version":"1.16.0, \u003c 1.16.1"}],"vulnerabilityVendor":[{"id":"23838e56-2dc3-3023-8c58-f91b85b669dc","vendor":{"name":"follow-redirects"}}]}}],"enisaIdAdvisory":[{"id":"21bc538d-3648-3b9b-97f2-b07ba6d9f6d3","advisory":{"id":"openSUSE-SU-2026:12261-1","description":"git-bug-0.11.0-3.1 on GA media","summary":"git-bug-0.11.0-3.1 on GA media","datePublished":"Oct 24, 2026, 12:00:00 AM","dateUpdated":"Oct 26, 2026, 10:35:11 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12261-1.json\nhttps://www.suse.com/security/cve/CVE-2026-110095/\nhttps://www.suse.com/security/cve/CVE-2026-110180/\nhttps://www.suse.com/security/cve/CVE-2026-110306/\nhttps://www.suse.com/security/cve/CVE-2026-110725/\nhttps://www.suse.com/security/cve/CVE-2026-110816/\nhttps://www.suse.com/security/cve/CVE-2026-111756/\nhttps://www.suse.com/security/cve/CVE-2026-112085/\nhttps://www.suse.com/security/cve/CVE-2026-112366/\nhttps://www.suse.com/security/cve/CVE-2026-78659/\nhttps://www.suse.com/security/cve/CVE-2026-78660/\nhttps://www.suse.com/security/cve/CVE-2026-78663/\nhttps://www.suse.com/security/cve/CVE-2026-78669/\nhttps://www.suse.com/security/cve/CVE-2026-97032/\n","aliases":"CVE-2026-110095\nCVE-2026-110180\nCVE-2026-110306\nCVE-2026-110725\nCVE-2026-110816\nCVE-2026-111756\nCVE-2026-112085\nCVE-2026-112366\nCVE-2026-78659\nCVE-2026-78660\nCVE-2026-78663\nCVE-2026-78669\nCVE-2026-97032\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"21104c49-7d3f-3ced-be4f-462121ba6e25","product":{"name":"git-bug-zsh-completion-0:0.11.0-3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"261d1262-7a24-3291-ae0a-cf8ee2897dc4","product":{"name":"git-bug-bash-completion-0:0.11.0-3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"28d1a614-d78f-35bd-9f31-5ba65ecb453d","product":{"name":"git-bug-fish-completion-0:0.11.0-3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"33b81846-9416-3a27-952d-8bd1156fe211","product":{"name":"git-bug-zsh-completion-0:0.11.0-3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5c4aadd7-834c-30b2-ab49-552098873dd1","product":{"name":"git-bug-zsh-completion-0:0.11.0-3.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"60d370d1-d4b0-3c56-b042-195469125d2d","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"62b65c55-369a-3672-886b-123a976a8e2b","product":{"name":"git-bug-bash-completion-0:0.11.0-3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"7c81aee8-593a-38b4-8975-33abe5c497d6","product":{"name":"git-bug-fish-completion-0:0.11.0-3.1.s390x","vendor":{"name":"SUSE"}}},{"id":"80c9da65-66fa-323b-8bbe-644e093c251c","product":{"name":"git-bug-fish-completion-0:0.11.0-3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"8c6a5843-c889-36cf-bba2-5689af1ab0a8","product":{"name":"git-bug-fish-completion-0:0.11.0-3.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ad866fa6-f9fe-3b55-9f10-43df7a3511a8","product":{"name":"git-bug-bash-completion-0:0.11.0-3.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c3506d5e-604f-3709-8f58-7467a975031a","product":{"name":"git-bug-bash-completion-0:0.11.0-3.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d0874260-b521-34ef-9cb8-77a62075c6cf","product":{"name":"git-bug-0:0.11.0-3.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"da11e239-fa5d-38e8-b767-670a8ac03c2a","product":{"name":"git-bug-0:0.11.0-3.1.s390x","vendor":{"name":"SUSE"}}},{"id":"e111b8ed-0dd9-3beb-9e00-d8da2405d3f1","product":{"name":"git-bug-0:0.11.0-3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e4659ed8-80d9-3a2d-a78e-ffcbaf6b0648","product":{"name":"git-bug-0:0.11.0-3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f218ef0e-8bbc-361a-bbee-55f04bbbb6a0","product":{"name":"git-bug-zsh-completion-0:0.11.0-3.1.s390x","vendor":{"name":"SUSE"}}}]}},{"id":"35d27766-1f56-358a-b7b0-576eb0cc9e02","advisory":{"id":"RHSA-2026:88537","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 23, 2026, 2:44:52 AM","dateUpdated":"Nov 2, 2026, 4:24:23 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:88537\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88537.json\n","aliases":"CVE-2026-65627\nCVE-2026-111755\nCVE-2026-111756\nCVE-2026-114125\nCVE-2026-114126\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"808e1ae6-5952-3079-91e5-6e5e55907a8f","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"b0ac5b27-79e5-3098-bc9c-60a32f88ef3c","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"e2e46c28-81e5-3771-8615-39f32be989d2","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"e354f31d-4406-3112-8c80-7f6ebc8b6eb4","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"ee6c0769-6bbd-36a3-a31e-d4cf7d0068b6","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"3fbbde74-1cb4-3e4e-861b-ea3071706c48","advisory":{"id":"RHSA-2026:88478","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 23, 2026, 1:10:24 AM","dateUpdated":"Oct 30, 2026, 6:54:48 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:88478\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88478.json\n","aliases":"CVE-2026-111755\nCVE-2026-111756\nCVE-2026-114125\nCVE-2026-114126\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"00b01034-98f9-3910-b49c-3b5736179aae","product":{"name":"grafana12.4-0:12.4.13-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"471e265c-9e89-3e31-85cd-919f8641339a","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"8b484f90-8a4e-3a2c-bcca-81ea341db71f","product":{"name":"grafana12.4-0:12.4.13-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"d98f79ac-2aea-31c6-aa4f-5e19eefb45fa","product":{"name":"grafana12.4-0:12.4.13-0.3.hum1@src","vendor":{"name":"Red Hat"}}}]}},{"id":"9708a7cc-991f-3651-bda6-ecd623bc29a0","advisory":{"id":"RHSA-2026:88541","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 23, 2026, 2:59:13 AM","dateUpdated":"Nov 2, 2026, 4:24:23 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:88541\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88541.json\n","aliases":"CVE-2026-40895\nCVE-2026-65627\nCVE-2026-111755\nCVE-2026-111756\nCVE-2026-114125\nCVE-2026-114126\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"12647ded-34be-3382-b4ea-96d80bc46606","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"1ba9a7b6-b93a-3827-8562-69c159281910","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"9a9b4d44-debf-39c6-afbd-db49c32117f1","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"a11f28bb-db66-3823-b996-24cea33e0f4e","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"a70351d2-2ed1-3591-a782-fce4c7f8bf32","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}}]}}]}