CVE-2026-111755 · GHSA-8r9p-f939-6h3c
follow-redirects sensitiveHeaders regex escaping can expose credential headers
- Risk score
- 67/100
- CVSS
- 8.2 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The follow-redirects library has a vulnerability where sensitive headers are not properly escaped, allowing an attacker to expose credential headers. An attacker could use this to steal credentials.
- Affected
- {'products': ['follow-redirects'], 'packages': ['npm'], 'versions': ['>= 1.16.0, < 1.16.1']}
- Fix
- Upgrade to version 1.16.1
- Exploitation
- No known exploitation
Story map
At a glance
follow-redirects: Amber, patch this week. The follow-redirects library has a vulnerability where sensitive headers are not properly escaped, allowing an attacker to expose credential headers. An attacker could use this to steal credentials.
The flaws
- CVE-2026-111755: Follow-redirects sensitiveHeaders regex escaping can expose credential headers (CVSS 8.2 · EPSS 0%)
- CVE-2026-111756: Follow-redirects array-form headers bypass cross-origin credential stripping (CVSS 8.2 · EPSS 0%)
The fix
Upgrade follow-redirects: 1.16.1 or later on your release line
Who is exposed: {'products': ['follow-redirects'], 'packages': ['npm'], 'versions': ['>= 1.16.0, < 1.16.1']}
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-185 (CWE-185). 2 other warnings in 30 days
Why it is Amber
- CVSS 8.2 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| follow-redirects | npm | >= 1.16.0, < 1.16.1 | 1.16.1 |
References
- https://github.com/advisories/GHSA-8r9p-f939-6h3c
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c
- https://nvd.nist.gov/vuln/detail/CVE-2026-111755
- https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8
- https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1
- https://github.com/advisories/GHSA-8r9p-f939-6h3c
Original description
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.
Last activity 19 Oct 2026. Patch Forecast updates every hour.