Skip to content
fr Sign in
8.2 High

CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects

Description

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.

Affected products and versions

Product Affected versions Fixed in
follow-redirects 1.16 1.16.0 → < 1.16.1 1.16.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of follow-redirects

The 5 CVEs of follow-redirects →
CVE-2026-116689 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects 5.9 Medium CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects 8.2 High CVE-2026-40895 follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows… 6.9 Medium CVE-2024-28849 follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows… 6.5 Medium
Track this CVE