Hi,

The following vulnerability was published for node-follow-redirects.

CVE-2026-111756[0]:
| follow-redirects is a Node.js HTTP and HTTPS client wrapper that
| automatically follows redirects. From version 1.16.0 to before
| version 1.16.1, follow-redirects removes sensitive credential
| headers (Authorization, Proxy-Authorization, Cookie, and any caller-
| declared sensitiveHeaders) before following a redirect that crosses
| to a different host or downgrades to a less secure protocol. The
| removal routine iterates the caller's headers container with
| for...in and matches header names against a filter. This assumes the
| headers container is a plain object keyed by header names. Node's
| underlying http.request, which follow-redirects is a drop-in
| replacement for, also accepts headers as an alternating array of
| names and values. For an array, for...in yields the numeric indices
| "0", "1", "2" and so on, which never match a header-name filter, so
| nothing is removed. An application that sends array-form headers and
| follows an attacker-controlled cross-origin redirect therefore
| forwards its Authorization, Cookie, and Proxy-Authorization headers
| verbatim to the attacker-controlled destination, with no error or
| warning. The sensitiveHeaders option added to fix CVE-2026-40895 /
| GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the
| same helper. This is an unauthenticated confidentiality
| vulnerability: any remote server the victim application contacts can
| harvest the victim's credential headers by responding with a cross-
| origin redirect. This issue has been patched in version 1.16.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111756
https://www.cve.org/CVERecord?id=CVE-2026-111756
[1] https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
[2] https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1151931 in node-follow-redirects reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-follow-redirects/-/commit/70b61ee9ae07aab7fb4efc4a16f162b9788065c9

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1151931

Hello,

Bug #1151931 in node-follow-redirects reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-follow-redirects/-/commit/70b61ee9ae07aab7fb4efc4a16f162b9788065c9

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1151931

We believe that the bug you reported is fixed in the latest version of
node-follow-redirects, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151931@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-follow-redirects package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 24 Oct 2026 21:44:35 +0200
Source: node-follow-redirects
Architecture: source
Version: 1.16.1+~1.14.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1151930 1151931
Changes:
 node-follow-redirects (1.16.1+~1.14.4-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version
     (Closes: #1151930, #1151931, CVE-2026-111755, CVE-2026-111756)
   * Unfuzz patches
Checksums-Sha1:
 f8856af50863a1e2f7da5ce00b50de38e044d452 2656 node-follow-redirects_1.16.1+~1.14.4-1.dsc
 ca054d72ef574c77949fc5fff278b430fcd508ec 2813 node-follow-redirects_1.16.1+~1.14.4.orig-types-follow-redirects.tar.gz
 45d2a482b9fbf37e0d1b61b2c6006ac8be719bca 94480 node-follow-redirects_1.16.1+~1.14.4.orig.tar.gz
 c29478681c8fd11a404a685846235099f6756f77 5244 node-follow-redirects_1.16.1+~1.14.4-1.debian.tar.xz
Checksums-Sha256:
 6999297567764fea8eb88d56e3cf833f03a297ad72efdbcfbb546041ed9d721c 2656 node-follow-redirects_1.16.1+~1.14.4-1.dsc
 88b7ad41ccdd6b77b864f048a67b7141dea86841a382d22b8b91f6c28f73a7d8 2813 node-follow-redirects_1.16.1+~1.14.4.orig-types-follow-redirects.tar.gz
 c4c29c70924490e319613e836e56bf116d2935490b1aed6331a5f9abfa0ba4de 94480 node-follow-redirects_1.16.1+~1.14.4.orig.tar.gz
 5fba7bff04b938226ab303844f79527081b962764c6fc21105d5dd8aee104a95 5244 node-follow-redirects_1.16.1+~1.14.4-1.debian.tar.xz
Files:
 c9c1a599b7871c92f0f89ae36fb06798 2656 javascript optional node-follow-redirects_1.16.1+~1.14.4-1.dsc
 719a7019d9e21269e285e4a7c45126dc 2813 javascript optional node-follow-redirects_1.16.1+~1.14.4.orig-types-follow-redirects.tar.gz
 36ce5eeb10a76f2433663e92f93d22eb 94480 javascript optional node-follow-redirects_1.16.1+~1.14.4.orig.tar.gz
 0f6cce569fa9ee8eab0861e4a16b2834 5244 javascript optional node-follow-redirects_1.16.1+~1.14.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrdCyEACgkQ9tdMp8mZ
7un/yQ//fpwR3JEeduoBXaz/36D1BHThgRH4X+g79bdMvZVIXZ2ZsW5qKtav/6t8
ix4A/WgoXiv7OoWvjyCSt5e7Egw9As6MUROyaxrW6fNXcUw9/VDz/v92ZJ9D4Y4I
K6/kVrqiW3XBoSZkUmXmZCMXkkewPhy+s3spfXqEfEVC/tJZSD40c/pxIMn/T6uT
Xq5Hlv1WIwWuUoPRxH72+QeVEMwofIqsCNkREOWnd7b5f4j8KOrRUEoFQ7AVUU8v
Ov0KTvasuFet2TyqFC64BNxZpal6kiyyK+ejWlPWueaJ4CUrYe9TyKGR/C8CyBWL
hIRMP0E79qMQ+U5urVwDWYlLsMcBRaXVDujgxukwqZPr2WDLDfVsLYv6vHy4OFCh
Tf//9G4hRaIKY8koaqwKzpfnTuJCrOGBycJxENPEJyDwhduwf+PBqOaiO/DK8uo8
xg8t9G7CSgq7qMnfPItMgHpkCd1IPFWN5KL0egP8IHWsaIa0AqWl0c0G9G2Qfnvc
Cw7SQNtiwA/0LIgpCGblQL/lCM6VTwxYaNiLz0yP+h+JQQfPyAajU94jL8urMRMM
3YeSC1nQXc7khBiY2FMAqI8Cg0UaAauEdhttqZ8Jb2lAjSrtEdmmoPonwUUzemn3
3Zj9dZrhWoePklK9fNbNQFHPA6ru36GxrmDr7mpH9c/5y8jA8m4=
=KdEz
-----END PGP SIGNATURE-----