CVE-2026-111755: follow-redirects sensitiveHeaders regex escaping can expose credential headers

Q: Which applications are exposed to credential-header forwarding?

Applications using follow-redirects from 1.16.0 through before 1.16.1 are exposed if they declare a sensitive header whose name contains ^ or | and follow a cross-origin or HTTPS-to-HTTP redirect.

Q: What must an attacker be able to do to exploit this issue?

The attacker needs to cause the client to follow a redirect to an attacker-controlled target. The vulnerable request must include a declared sensitive header with a name containing ^ or |.

Q: Are all sensitive headers affected?

No. The issue applies to declared sensitive header names containing the ^ or | regular-expression metacharacters; those characters can prevent the generated filter from matching the header name.

Q: What is the remediation?

Update follow-redirects to version 1.16.1, which fixes the regex escaping issue.

Published Oct 19, 2026

Updated

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.

Affected Software

1 affected component

npm/follow-redirects>=1.16.0<1.16.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade follow-redirects to a version that resolves this vulnerability.
Fixed in 1.16.1

Event History

Oct 19, 2026

CVE Published

via MITRE·05:27 PM

Data Sourced

via MITRE·05:27 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to credential-header forwarding?

Applications using follow-redirects from 1.16.0 through before 1.16.1 are exposed if they declare a sensitive header whose name contains ^ or | and follow a cross-origin or HTTPS-to-HTTP redirect.

What must an attacker be able to do to exploit this issue?

The attacker needs to cause the client to follow a redirect to an attacker-controlled target. The vulnerable request must include a declared sensitive header with a name containing ^ or |.

Are all sensitive headers affected?

No. The issue applies to declared sensitive header names containing the ^ or | regular-expression metacharacters; those characters can prevent the generated filter from matching the header name.

What is the remediation?

Update follow-redirects to version 1.16.1, which fixes the regex escaping issue.

CVE-2026-111755: follow-redirects sensitiveHeaders regex escaping can expose credential headers

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to credential-header forwarding?

What must an attacker be able to do to exploit this issue?

Are all sensitive headers affected?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to credential-header forwarding?

What must an attacker be able to do to exploit this issue?

Are all sensitive headers affected?

What is the remediation?