CVE-2026-111756Published
follow-redirects array-form headers bypass cross-origin credential stripping
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111756 · Microsoft / collected KEV context
cve-program · CVE-2026-111756
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
- https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff
- https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1
euvd · EUVD-2026-105225
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
- https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff
- https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1
nvd · CVE-2026-111756
- https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff
- https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
osv · GHSA-q3jh-wrc6-jgq8
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
- https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff
- https://github.com/follow-redirects/follow-redirects
- https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1
Related operational evidence
Explicit CVE identifiers- follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cooki… · Advisory content revised · 1 Nov 2026
- follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cooki… · Advisory content revised · 30 Oct 2026