follow-redirects array-form headers bypass cross-origin credential stripping

影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1

follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects…

GitHub Advisory Database에서 읽기

2026. 10. 21. 오전 02:58, GitHub Advisory Database에서 "follow-redirects array-form headers bypass cross-origin credential stripping"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-111756.