{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/follow-redirects--1.16.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:follow-redirects_project:follow-redirects:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-40895"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["follow-redirects (\u003c= 1.16.0)"],"_cs_severities":["high"],"_cs_tags":["credential-access","nodejs","web-application"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003efollow-redirects\u003c/code\u003e library, a popular drop-in replacement for Node.js's native \u003ccode\u003ehttp\u003c/code\u003e/\u003ccode\u003ehttps\u003c/code\u003e modules, contains a vulnerability where sensitive header-stripping mechanisms fail when headers are provided as an array rather than a plain object. The internal \u003ccode\u003eremoveMatchingHeaders\u003c/code\u003e function utilizes a \u003ccode\u003efor...in\u003c/code\u003e loop to iterate over the headers container. While this correctly matches keys in an object, it iterates over numeric indices when applied to an array, causing the header-matching regular expressions to consistently fail.\u003c/p\u003e\n\u003cp\u003eThis flaw affects the security controls intended to protect credentials (Authorization, Cookie, Proxy-Authorization) and user-declared \u003ccode\u003esensitiveHeaders\u003c/code\u003e (introduced in CVE-2026-40895) when a request is redirected to a different origin or a less secure protocol. Because the library silently fails to sanitize these headers, the credentials are forwarded verbatim to the attacker-controlled redirect destination. This vulnerability enables unauthenticated credential harvesting and persists in all versions of the library up to and including 1.16.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe victim application is configured to use \u003ccode\u003efollow-redirects\u003c/code\u003e for outgoing HTTP/HTTPS requests.\u003c/li\u003e\n\u003cli\u003eThe application initiates a request to a malicious or compromised server, providing credentials via array-form headers (e.g., \u003ccode\u003e[\u0026quot;Authorization\u0026quot;, \u0026quot;Bearer token\u0026quot;, \u0026quot;Cookie\u0026quot;, \u0026quot;session=id\u0026quot;]\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe malicious server responds with a 302 or similar redirect status code pointing to an attacker-controlled cross-origin host or a protocol-downgrade (HTTPS to HTTP) endpoint.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003efollow-redirects\u003c/code\u003e intercepts the redirect and invokes \u003ccode\u003eremoveMatchingHeaders\u003c/code\u003e to strip sensitive credentials and the original \u003ccode\u003eHost\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eremoveMatchingHeaders\u003c/code\u003e function iterates over the array-form headers using \u003ccode\u003efor...in\u003c/code\u003e, yielding numeric indices instead of header names, which results in zero matches.\u003c/li\u003e\n\u003cli\u003eThe sanitization logic fails silently; the library retains the original credential headers and the stale \u003ccode\u003eHost\u003c/code\u003e header in the options object.\u003c/li\u003e\n\u003cli\u003eThe library follows the redirect, sending the request to the attacker's server with the victim's credentials included in the headers.\u003c/li\u003e\n\u003cli\u003eThe attacker logs the incoming request headers to harvest the victim's tokens, session cookies, or API keys.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in the unauthorized disclosure of sensitive authentication material to third-party servers. Any application utilizing \u003ccode\u003efollow-redirects\u003c/code\u003e that processes user-controllable or untrusted redirects is susceptible to credential harvesting. This impacts the confidentiality of session identifiers, API keys, and authorization tokens across any sector relying on the library for automated HTTP request handling.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate to a version of \u003ccode\u003efollow-redirects\u003c/code\u003e that implements explicit validation for array-form headers, ensuring either proper sanitization or a clear \u003ccode\u003eTypeError\u003c/code\u003e if array-form input is detected.\u003c/li\u003e\n\u003cli\u003eAudit applications using \u003ccode\u003efollow-redirects\u003c/code\u003e to determine if outgoing requests are constructed using array-form headers (e.g., \u003ccode\u003e[\u0026quot;Name\u0026quot;, \u0026quot;Value\u0026quot;]\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eImplement strict cross-origin checks or proxying for sensitive traffic if an immediate patch is not feasible.\u003c/li\u003e\n\u003cli\u003eEnsure all developers explicitly use object-form headers (\u003ccode\u003e{ \u0026quot;Authorization\u0026quot;: \u0026quot;value\u0026quot; }\u003c/code\u003e) until the library explicitly validates array-form header structures.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T23:56:00Z","date_published":"2026-10-20T23:56:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-follow-redirects-bypass/","summary":"The follow-redirects library fails to strip sensitive headers when provided in array format, leading to the unauthorized disclosure of credentials during cross-origin or protocol-downgrade redirects.","title":"follow-redirects: Array-form header credential stripping bypass","url":"https://feed.craftedsignal.io/briefs/2026-10-follow-redirects-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Follow-Redirects (\u003c= 1.16.0)","version":"https://jsonfeed.org/version/1.1"}