Improper Protection of Alternate Path Affecting renovate package, versions <44.60.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-RENOVATE-21181021
- published18 Oct 2026
- disclosed15 Oct 2026
- creditjamietanna
Introduced: 15 Oct 2026
NewCVE-2026-110865 (opens in a new tab)How to fix?
Upgrade renovate to version 44.60.1 or higher.
Overview
renovate is a dependency updater.
Affected versions of this package are vulnerable to Improper Protection of Alternate Path via the find function in lib/util/host-rules.ts, where administrator-configured HTTP headers (such as authentication credentials) for one host can be sent to a different host controlled by a repository. When host rules are merged using additive Object.assign({}, ...matchedHeaders), a repository-level rule that sets any header for the same host causes the administrator's masked headers to be included in requests to that host, with no log entry or error indicating the leakage occurred. An attacker does not need to know which credential is configured or act maliciously - any repository-level header for the matching host is sufficient to trigger the exposure.
Note: This is only exploitable when a self-hosted administrator has configured headers in their global config and has allowlisted them via allowedHeaders, allowing repository-level config to also set headers for the same host.