{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "follow-redirects: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/follow-redirects--follow-redirects/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/follow-redirects--follow-redirects/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111756/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111756/",
   "title": "CVE-2026-111756 · follow-redirects · disclosed",
   "content_text": "follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.",
   "date_published": "2026-10-20T17:58:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111756/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111756/",
   "title": "CVE-2026-111756 · follow-redirects · fixed in Chainguard (azurite 3.37.0-r7 and 57 more)",
   "content_text": "Fixed versions: azurite 3.37.0-r7, code-server 4.141.0-r3, commercial-gitlab-rails-ee-fips-19.1 19.1.9-r0, configurable-http-proxy 5.3.0-r3, gitlab-rails-ce-19.0 19.0.10-r0, gitlab-rails-ce-19.1 19.1.9-r0, gitlab-rails-ce-19.3 19.3.6-r0, gitlab-rails-ce-19.4 19.4.3-r1, homepage 2.6.0-r1, kibana-8.19 8.19.23-r4, kibana-8.19-bitnami 8.19.23-r4, kibana-9.3 9.3.8-r8, kibana-9.4 9.4.8-r1, kibana-9.5 9.5.5-r2, kubeflow-pipelines-frontend 2.17.2-r13, lambda-nodejs22 4.0.2-r6, lambda-nodejs24 4.0.2-r6, langfuse-3 3.225.12-r6, langfuse-3-worker 3.225.12-r6, langfuse-4 4.68.0-r0, langfuse-4-worker 4.68.0-r0, langfuse-fips-3 3.225.12-r5, langfuse-fips-3-worker 3.225.12-r5, langfuse-fips-4 4.68.0-r0, langfuse-fips-4-worker 4.68.0-r0, lerna 10.1.1-r1, nextcloud-server-33 33.0.10-r3, nextcloud-server-34 34.0.5-r2, nextcloud-server-35 35.0.0-r9, opensearch-dashboards-2 2.19.6-r33, opensearch-dashboards-2-fips 2.19.6-r18, opensearch-dashboards-3 3.9.0-r3, opensearch-dashboards-3-fips 3.9.0-r1, prism 5.16.0-r17, redisinsight 3.8.0-r12, semaphore 2.19.17-r1, unleash 8.2.1-r0, unleash-fips 8.2.0-r7, wazuh-dashboard 4.14.9-r3, wazuh-dashboard-alerting-dashboards-plugin 4.14.9-r3, wazuh-dashboard-alerting-dashboards-plugin-fips 4.14.9-r2, wazuh-dashboard-anomaly-detection-dashboards-plugin 4.14.9-r3, wazuh-dashboard-anomaly-detection-dashboards-plugin-fips 4.14.9-r2, wazuh-dashboard-dashboards-maps 4.14.9-r3, wazuh-dashboard-dashboards-maps-fips 4.14.9-r2, wazuh-dashboard-dashboards-notifications 4.14.9-r3, wazuh-dashboard-dashboards-notifications-fips 4.14.9-r2, wazuh-dashboard-dashboards-reporting 4.14.9-r3, wazuh-dashboard-dashboards-reporting-fips 4.14.9-r2, wazuh-dashboard-dashboards-visualizations 4.14.9-r3, wazuh-dashboard-dashboards-visualizations-fips 4.14.9-r2, wazuh-dashboard-fips 4.14.9-r2, wazuh-dashboard-index-management-dashboards-plugin 4.14.9-r3, wazuh-dashboard-index-management-dashboards-plugin-fips 4.14.9-r2, wazuh-dashboard-plugins 4.14.9-r3, wazuh-dashboard-plugins-fips 4.14.9-r2, wazuh-dashboard-security-plugin 4.14.9-r3, wazuh-dashboard-security-plugin-fips 4.14.9-r2.",
   "date_published": "2026-10-20T17:58:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111756/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111756/",
   "title": "CVE-2026-111756 · follow-redirects · fixed upstream (npm)",
   "content_text": "Fixed versions: follow-redirects 1.16.1.",
   "date_published": "2026-10-20T17:58:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111756/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111756/",
   "title": "CVE-2026-111756 · follow-redirects · fixed in openSUSE Tumbleweed (git-bug 0.11.0-3.1)",
   "content_text": "Fixed versions: git-bug 0.11.0-3.1.",
   "date_published": "2026-10-20T17:58:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111756/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111756/",
   "title": "CVE-2026-111756 · follow-redirects · fixed in Wolfi (code-server 4.141.0-r3 and 8 more)",
   "content_text": "Fixed versions: code-server 4.141.0-r3, configurable-http-proxy 5.3.0-r3, kubeflow-pipelines-frontend 2.17.2-r13, langfuse-3 3.225.12-r6, langfuse-3-worker 3.225.12-r6, lerna 10.1.1-r1, nextcloud-server-33 33.0.10-r3, opensearch-dashboards-3 3.9.0-r3, prism 5.16.0-r17.",
   "date_published": "2026-10-20T17:58:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111755/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111755/",
   "title": "CVE-2026-111755 · follow-redirects · disclosed",
   "content_text": "follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.",
   "date_published": "2026-10-19T17:27:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111755/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111755/",
   "title": "CVE-2026-111755 · follow-redirects · fixed in Chainguard (azurite 3.37.0-r7 and 57 more)",
   "content_text": "Fixed versions: azurite 3.37.0-r7, code-server 4.141.0-r3, commercial-gitlab-rails-ee-fips-19.1 19.1.9-r0, configurable-http-proxy 5.3.0-r3, gitlab-rails-ce-19.0 19.0.10-r0, gitlab-rails-ce-19.1 19.1.9-r0, gitlab-rails-ce-19.3 19.3.6-r0, gitlab-rails-ce-19.4 19.4.3-r1, homepage 2.6.0-r1, kibana-8.19 8.19.23-r4, kibana-8.19-bitnami 8.19.23-r4, kibana-9.3 9.3.8-r8, kibana-9.4 9.4.8-r1, kibana-9.5 9.5.5-r2, kubeflow-pipelines-frontend 2.17.2-r13, lambda-nodejs22 4.0.2-r6, lambda-nodejs24 4.0.2-r6, langfuse-3 3.225.12-r6, langfuse-3-worker 3.225.12-r6, langfuse-4 4.68.0-r0, langfuse-4-worker 4.68.0-r0, langfuse-fips-3 3.225.12-r5, langfuse-fips-3-worker 3.225.12-r5, langfuse-fips-4 4.68.0-r0, langfuse-fips-4-worker 4.68.0-r0, lerna 10.1.1-r1, nextcloud-server-33 33.0.10-r3, nextcloud-server-34 34.0.5-r2, nextcloud-server-35 35.0.0-r9, opensearch-dashboards-2 2.19.6-r33, opensearch-dashboards-2-fips 2.19.6-r18, opensearch-dashboards-3 3.9.0-r3, opensearch-dashboards-3-fips 3.9.0-r1, prism 5.16.0-r17, redisinsight 3.8.0-r12, semaphore 2.19.17-r1, unleash 8.2.1-r0, unleash-fips 8.2.0-r7, wazuh-dashboard 4.14.9-r3, wazuh-dashboard-alerting-dashboards-plugin 4.14.9-r3, wazuh-dashboard-alerting-dashboards-plugin-fips 4.14.9-r2, wazuh-dashboard-anomaly-detection-dashboards-plugin 4.14.9-r3, wazuh-dashboard-anomaly-detection-dashboards-plugin-fips 4.14.9-r2, wazuh-dashboard-dashboards-maps 4.14.9-r3, wazuh-dashboard-dashboards-maps-fips 4.14.9-r2, wazuh-dashboard-dashboards-notifications 4.14.9-r3, wazuh-dashboard-dashboards-notifications-fips 4.14.9-r2, wazuh-dashboard-dashboards-reporting 4.14.9-r3, wazuh-dashboard-dashboards-reporting-fips 4.14.9-r2, wazuh-dashboard-dashboards-visualizations 4.14.9-r3, wazuh-dashboard-dashboards-visualizations-fips 4.14.9-r2, wazuh-dashboard-fips 4.14.9-r2, wazuh-dashboard-index-management-dashboards-plugin 4.14.9-r3, wazuh-dashboard-index-management-dashboards-plugin-fips 4.14.9-r2, wazuh-dashboard-plugins 4.14.9-r3, wazuh-dashboard-plugins-fips 4.14.9-r2, wazuh-dashboard-security-plugin 4.14.9-r3, wazuh-dashboard-security-plugin-fips 4.14.9-r2.",
   "date_published": "2026-10-19T17:27:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111755/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111755/",
   "title": "CVE-2026-111755 · follow-redirects · fixed upstream (npm)",
   "content_text": "Fixed versions: follow-redirects 1.16.1.",
   "date_published": "2026-10-19T17:27:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111755/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111755/",
   "title": "CVE-2026-111755 · follow-redirects · fixed in Wolfi (code-server 4.141.0-r3 and 8 more)",
   "content_text": "Fixed versions: code-server 4.141.0-r3, configurable-http-proxy 5.3.0-r3, kubeflow-pipelines-frontend 2.17.2-r13, langfuse-3 3.225.12-r6, langfuse-3-worker 3.225.12-r6, lerna 10.1.1-r1, nextcloud-server-33 33.0.10-r3, opensearch-dashboards-3 3.9.0-r3, prism 5.16.0-r17.",
   "date_published": "2026-10-19T17:27:09Z"
  }
 ]
}