{"id":"ghsa-ghsa-q3jh-wrc6-jgq8","seq":2427,"kind":"advisory","title":"follow-redirects array-form headers bypass cross-origin credential stripping","url":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-q3jh-wrc6-jgq8","summary":"影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1\nSummary follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-111756"],"tags":["GHSA-q3jh-wrc6-jgq8","follow-redirects"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T17:58:04.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}