CVE-2026-111755: follow-redirects Credential Header Exposure via Regex Escaping
Summary
CVE-2026-111755: follow-redirects sensitiveHeaders regex escaping can expose credential headers. Affects follow-redirects versions >= 1.16.0, < 1.16.1. Fixed in 1.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The follow-redirects package is a popular Node.js library that simplifies the handling of HTTP redirects. It allows developers to follow redirects seamlessly while maintaining control over the request headers. However, a recent vulnerability has been discovered in version 1.16.0, which affects its ability to properly sanitize sensitive headers during cross-origin redirects.
Vulnerability Detail
The vulnerability arises from the introduction of the 'sensitiveHeaders' option in follow-redirects 1.16.0, which is intended to remove specified headers when a redirect occurs. The regex used to filter these headers does not escape all metacharacters correctly, allowing headers containing characters like '^' and '|' to bypass the filter. This can lead to sensitive information, such as API tokens or credentials, being inadvertently sent to an attacker-controlled destination without any warning. The issue is silent, meaning applications may believe they are protected when they are not, leading to potential data breaches.
How To Fix
Latest published version: 1.16.1 as of 22 Oct 2026
npm install follow-redirects@1.16.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider avoiding the use of sensitive header names that contain metacharacters like '^' or '|'. Additionally, you can implement a manual check to strip sensitive headers before making requests that may follow redirects.
Conclusion
The follow-redirects package has a significant vulnerability that can expose sensitive headers due to improper regex escaping. It is crucial for developers using this library to update to the patched version 1.16.1 to ensure that their applications are secure from potential data leaks.
See every vulnerability recorded for follow-redirects →
FAQ
The CVSS score for this vulnerability is 8.2, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Sensitive headers are HTTP headers that may contain confidential information, such as API keys, authentication tokens, or user credentials.
If you cannot update the package, avoid using sensitive header names with metacharacters and implement manual checks to strip sensitive headers before redirects.
Yes, using the vulnerable version can lead to silent exposure of sensitive information to attacker-controlled destinations during cross-origin redirects.
References
Related vulnerabilities
Recent vulnerabilities recorded for follow-redirects.
