https://shellvoide.com/blog/blog The Shellvoide security blog: AI-driven penetration testing, vulnerability research, and application security insights from the team behind KLUE. en-us info@shellvoide.com (Shellvoide) info@shellvoide.com (Shellvoide) Fri, 23 Oct 2026 00:00:00 GMT https://shellvoide.com/blog/blog/follow-redirects-credential-header-leaks https://shellvoide.com/blog/blog/follow-redirects-credential-header-leaks follow-redirects is the redirect-following layer under axios and a large part of the Node HTTP ecosystem. We found two separate ways its cross-origin credential-header stripping control fails silently, one through a type assumption that the header container is always a plain object, and one through an incomplete regular-expression escaper. Both break the protection introduced to fix prior CVEs. Both were reported, accepted, assigned CVEs (CVE-2026-111756 and CVE-2026-111755), and fixed in 1.16.1. Fri, 23 Oct 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) kluecase-studyvulnerability-researchinformation-disclosurecredential-leakjavascriptnodejsfollow-redirectsaxioshttp-clientapi-securityautonomous-securityappsec