[ CVE-2026-111755 · Published 19 Oct 2026 ]
follow-redirects sensitiveHeaders regex escaping can expose credential headers
CVSS 8.2
EPSS <1%Fix available
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.
[ Fixes ]Fixes and patches
- follow-redirects 1.16.1Fixed version · GitHub Advisories · npm package follow-redirects: upgrade to 1.16.1 or later (affected >= 1.16.0, < 1.16.1)
[ Packages ]Affected open-source packages
- follow-redirects npmAffected >= 1.16.0, < 1.16.1 · fixed in 1.16.1 · GHSA-8r9p-f939-6h3c