{"id":"CVE-2026-111755","summary":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","details":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.","aliases":["GHSA-8r9p-f939-6h3c"],"modified":"2026-10-20T02:44:45.236217342Z","published":"2026-10-19T17:27:09.215Z","database_specific":{"cwe_ids":["CWE-185","CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111755.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111755.json"},{"type":"FIX","url":"https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8"},{"type":"WEB","url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"},{"type":"ADVISORY","url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/follow-redirects/follow-redirects","events":[{"introduced":"0c23a223067201c368035e82954c11eb2578a33b"},{"fixed":"46301256333c90b7faac7aa126effe72ec16d16e"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"1.16.0"},{"fixed":"1.16.1"}]}}],"versions":["v1.16.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111755.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}