Log in Start free

Vulnerability · Published Oct 19, 2026 · Assigned by GitHub_M

CVE-2026-111755follow-redirects sensitiveHeaders regex escaping can expose credential headers

High 8.2

In plain English

A high-severity information exposure in follow-redirects from follow-redirects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.5%top 59.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-follow-redirectsno fix listedDEBIAN-CVE-2026-111755
Debian:13node-follow-redirectsno fix listedDEBIAN-CVE-2026-111755
Debian:14node-follow-redirects1.16.1+~1.14.4-1DEBIAN-CVE-2026-111755
Ubuntu:26.10node-follow-redirectsno fix listedUBUNTU-CVE-2026-111755
npmfollow-redirects1.16.1GHSA-8r9p-f939-6h3c

Affected products (as reported)

VendorProductVersions
follow-redirects follow-redirects >= 1.16.0, < 1.16.1

Weakness: CWE-185, CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References