Axios

follow-redirects is the redirect-following layer under axios and a large part of the Node HTTP ecosystem. We found two separate ways its cross-origin credential-header stripping control fails silently, one through a type assumption that the header container is always a plain object, and one through an incomplete regular-expression escaper. Both break the protection introduced to fix prior CVEs. Both were reported, accepted, assigned CVEs (CVE-2026-111756 and CVE-2026-111755), and fixed in 1.16.1.

axios is the HTTP client most JavaScript and Node apps use to make requests. While reading through it, our security agent KLUE found a bug in how axios chooses the request method. On the default axios object, if another flaw in your app has polluted Object.prototype, a call you wrote as a safe GET can quietly go out as a DELETE, POST, PUT, or PATCH. Here is how KLUE found it, why only some ways of calling axios are affected, and how it was fixed.