follow-redirects EUVD-2026-105225

Requires that the victim application pass request headers to follow-redirects as Node's alternating name/value array (e.g. ['Authorization', 'token', ...]) rather than as a plain object - this is the precise trigger, because for...in over an array yields numeric indices that never match the credential filter. It additionally requires that those headers include credentials (Authorization, Proxy-Authorization, Cookie, or declared sensitiveHeaders) and that the application follows a redirect to a different host or a downgraded protocol controlled or influenced by the attacker. Limiting factors: the vulnerable range is only 1.16.0 to before 1.16.1, object-form headers (the common case) are not affected, and the attacker must be able to serve or influence the redirect response the victim follows; the previously-recommended sensitiveHeaders mitigation does NOT limit exploitation because it uses the same broken helper.

Signals are moderately consistent and point to a real but conditional confidentiality risk rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H) yields 8.2 (High): network-reachable, unauthenticated, no user interaction, high confidentiality impact - but critically AT:P (Attack Requirements present) encodes that exploitation only works when the victim application passes headers in Node's array form, a non-default usage pattern. No EPSS score, KEV listing, or public POC was supplied, so there is no evidence of active or at-scale exploitation; exploitation status is 'no public exploit identified at time of analysis.' The absence of KEV combined with the AT:P requirement suggests this is a latent supply-chain weakness, not a widely-weaponized one. The strongest mitigating factor not captured by the headline CVSS number is the narrow affected range (>=1.16.0, <1.16.1) and the array-form-header precondition - most callers use object-form headers and are unaffected. Note one nuance to verify: the flaw also defeats the sensitiveHeaders mitigation shipped for CVE-2026-40895, so environments relying on that earlier fix may believe they are protected when they are not.

A victim Node.js service uses follow-redirects (1.16.0) with array-form request headers that include an Authorization or Cookie, and makes an outbound request to a server an attacker controls or can influence. That server replies with a 30x redirect to a different host; because the credential-stripping routine iterates an array with for...in and only sees numeric indices, no headers are removed and the victim's credentials are sent verbatim to the attacker's host. No public exploit code was provided, but the GHSA advisory and patch commit fully document the mechanism.