Source: node-follow-redirects Version: 1.16.0+~1.14.4-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for node-follow-redirects. CVE-2026-111756[0]: | follow-redirects is a Node.js HTTP and HTTPS client wrapper that | automatically follows redirects. From version 1.16.0 to before | version 1.16.1, follow-redirects removes sensitive credential | headers (Authorization, Proxy-Authorization, Cookie, and any caller- | declared sensitiveHeaders) before following a redirect that crosses | to a different host or downgrades to a less secure protocol. The | removal routine iterates the caller's headers container with | for...in and matches header names against a filter. This assumes the | headers container is a plain object keyed by header names. Node's | underlying http.request, which follow-redirects is a drop-in | replacement for, also accepts headers as an alternating array of | names and values. For an array, for...in yields the numeric indices | "0", "1", "2" and so on, which never match a header-name filter, so | nothing is removed. An application that sends array-form headers and | follows an attacker-controlled cross-origin redirect therefore | forwards its Authorization, Cookie, and Proxy-Authorization headers | verbatim to the attacker-controlled destination, with no error or | warning. The sensitiveHeaders option added to fix CVE-2026-40895 / | GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the | same helper. This is an unauthenticated confidentiality | vulnerability: any remote server the victim application contacts can | harvest the victim's credential headers by responding with a cross- | origin redirect. This issue has been patched in version 1.16.1. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-111756 https://www.cve.org/CVERecord?id=CVE-2026-111756 [1] https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8 [2] https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff Please adjust the affected versions in the BTS as needed. Regards, Salvatore -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
