Api-security

follow-redirects is the redirect-following layer under axios and a large part of the Node HTTP ecosystem. We found two separate ways its cross-origin credential-header stripping control fails silently, one through a type assumption that the header container is always a plain object, and one through an incomplete regular-expression escaper. Both break the protection introduced to fix prior CVEs. Both were reported, accepted, assigned CVEs (CVE-2026-111756 and CVE-2026-111755), and fixed in 1.16.1.

axios is the HTTP client most JavaScript and Node apps use to make requests. While reading through it, our security agent KLUE found a bug in how axios chooses the request method. On the default axios object, if another flaw in your app has polluted Object.prototype, a call you wrote as a safe GET can quietly go out as a DELETE, POST, PUT, or PATCH. Here is how KLUE found it, why only some ways of calling axios are affected, and how it was fixed.

We asked KLUE, our AI security agent, to review kin-openapi, a library that a large share of Go web APIs use to read and check incoming requests. It found three separate bugs that each let anyone crash the service with a single request. The pattern behind all three is the same: the library already had the right safety check, it was just missing on one of the paths that needed it. All three were reported, accepted, assigned CVEs (CVE-2026-100352, CVE-2026-100353, CVE-2026-100354), rated High, and fixed by the maintainers.

A practical JWT security guide covering what JWT is, common JWT vulnerabilities, JWT attacks, exploit techniques, and defensive best practices for developers, pentesters, and API security teams.

Complete API pentesting checklist with OWASP API Top 10 (2023), BOLA/IDOR tests, JWT and OAuth checks, GraphQL security testing, SSRF payloads, business logic abuse scenarios, and reporting guidance.