CVE-2026-111755
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
follow-redirects versions 1.16.0 through 1.16.1 fail to escape regex metacharacters (^ or |) in sensitive header names. As a result, on cross-origin or HTTPS-to-HTTP redirects, the generated filter does not match the declared header and the credential header is forwarded to an attacker-controlled redirect target. The issue is fixed in version 1.16.1.
Risk Assessment
Sensitive headers (e.g., authorization tokens) may leak to an unknown redirect target, enabling session hijacking or unauthorized access to protected resources.
Recommendation
Update follow-redirects to version 1.16.1 or later and review applications using this library for cross-origin redirect handling.
Other vulnerabilities in follow-redirects
See all- CVE-2026-111756High
The follow-redirects library removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The description points to an issue in the header-removal routine, which iterates over the caller-provided structure.
- CVE-2026-40895High
In the follow-redirects library for Node.js, a vulnerability was found where custom authentication headers (e.g., X-API-Key, X-Auth-Token) are not stripped during cross-domain redirects. An attacker could exploit this to intercept sensitive credentials.
Original NVD description (English source)
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS