npm/follow-redirects CVE-2026-111756: high 8.2
follow-redirects array-form headers bypass cross-origin credential stripping
Action: Upgrade follow-redirects to 1.16.1 or later.
npm i follow-redirects@1.16.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.16.0 | 1.16.1 | - |
Fixed versions
| 1.16.1 |
Sources
- osv: GHSA-q3jh-wrc6-jgq8
- nvd: CVE-2026-111756
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
- https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff
- https://github.com/follow-redirects/follow-redirects
- https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1
CVE-2026-111756 · published · modified · JSON