{"id":"CVE-2026-111756","title":"follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects (CVE-2026-111756)","summary":"A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-212","CWE-200"],"vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["hardened_images"],"patched":["hardened_images"],"published":"2026-10-20","updated":"2026-10-23","sourceUpdated":"2026-10-23T05:02:12+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-111756"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556370"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111756"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756"},{"url":"https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff"},{"url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"},{"url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"},{"url":"https://access.redhat.com/errata/RHSA-2026:88478"},{"url":"https://access.redhat.com/errata/RHSA-2026:88537"},{"url":"https://access.redhat.com/errata/RHSA-2026:88541"},{"url":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8"}],"tags":["csaf","vex","red-hat","cve.org","exploit-available","ghsa","npm"],"epss":0.00471,"epssPercentile":0.40573,"aliases":["GHSA-q3jh-wrc6-jgq8"],"ecosystem":"npm","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T01:59:05.315622Z"},"scores":{"vendor":7.5,"cna":8.2},"ingestedAt":"2026-10-20T18:14:37.213Z","slug":"CVE-2026-111756","body":"## Overview\n\nA flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redirect to capture authentication tokens and session cookies, leading to sensitive information disclosure.\n\n## Vendor advisories\n\n- **RHSA-2026:88478** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88478)\n- **RHSA-2026:88537** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88537)\n- **RHSA-2026:88541** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88541)\n- **Red Hat VEX** · Important · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111756.json)\n\n**follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects** — rated Important by Red Hat. Released 2026-10-20, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Hardened Images\n\nFixed:\n\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat Hardened Images\n\nNot affected:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88478\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88537\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88541\n\nWorkarounds / mitigations:\n\n- --- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to format all outgoing HTTP request headers as plain key-value objects rather than al…\n\n## Package advisory (CVE-2026-111756)\n\nAffected packages:\n\n- `follow-redirects >= 1.16.0, < 1.16.1`\n\nPatched in:\n\n- `follow-redirects 1.16.1`\n\nSource: https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":228171,"id":"CVE-2026-111756","ts":1792758146270,"field":"cvss","old":"8.2","new":"7.5"},{"seq":227917,"id":"CVE-2026-111756","ts":1792721609147,"field":"exploit_available","old":"false","new":"true"}]}