@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub

Description

@microsoft/kiota-http-fetchlibrary’s RedirectHandler is documented as stripping Authorization and Cookie from cross-origin redirect targets, but the default scrubSensitiveHeaders callback in RedirectHandlerOptions uses case-sensitive property deletion (delete headers.Authorization, delete headers.Cookie) on a headers object that FetchRequestAdapter.getRequestFromRequestInformation has already lower-cased.

Recommendation

Update the @microsoft/kiota-http-fetchlibrary package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.0-preview.97, <= 1.0.0-preview.101
• Patched version(s): 1.0.0-preview.102

References

• GHSA-396q-4vc8-28x9
• CVE-2026-49336
• CWE-178
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter - CVE-2026-44487
• Papra HTTP redirect bypass can lead to SSRF via webhook delivery system - CVE-2026-48051
• Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) - CVE-2026-42259
• Strapi may leak sensitive data via relational filtering due to lack of query sanitization - CVE-2026-27886

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@microsoft/kiota-http-fetchlibrary