Vulnerability · CVE-2026-111755
follow-redirects sensitiveHeaders regex escaping can expose credential headers
Published Oct 19, 2026 · catalog updated Oct 20, 2026 · follow-redirects sensitiveHeaders regex escaping
Last checked Oct 31, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-111755. EPSS is 0.47%. Act only if a listed version of follow-redirects sensitiveHeaders regex escaping is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (follow-redirects sensitiveHeaders regex escaping).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
Same product and reporting
- CVE-2026-40895 · Medium
- Severity
- High8.2
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.47%
- Remediation
- Advisory link
- Affected products
- npm follow-redirects · vendor follow-redirects follow-redirects
### Summary follow-redirects 1.16.0 introduced the option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each through . escapes only a partial set of metacharacters and leaves , , , , and unescaped. Header names may legitimately contain and (both are valid RFC 9110 token characters that Node accepts and sends), and for a declared name containing either, the generated pattern can never match the intended header. As a result, an application that adopts this option to protect a custom credential header, then follows an attacker-controlled cross-origin redirect, forwards that credential to the attacker with no error or warning, while believing it is protected. The failure is silent: the protection simply does not exist for the affected names. The built-in list (Authorization, Proxy-Authorization, Cookie) contains no metacharacters and is not affected by this defect. ### Details The filter is constructed once, in the constructor at : at : The character class escapes , , , , , , , , , and . It omits , , , , and . Of these, Node's accepts and in header names (they are valid values under RFC 9110) and rejects , , with , so and are the reachable vectors for a silent credential leak. Separately, although , , cannot appear as live header names, declaring a entry that contains one of them injects an unbalanced token into the alternation (for example an unterminated character class), so the filter throws a in the constructor and the request fails to start. That case is a loud request-time crash from the same incomplete-escaping root cause rather than a silent bypass, and the canonical escaper below fixes it as well. For a declared sensitive header name containing an unescaped metacharacter, the
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- npm follow-redirects1.16.0 → 1.16.1
- vendor follow-redirects follow-redirectsversion unspecified
How to fix CVE-2026-111755
Upgrade
CVE-2026-111755 lists a fix boundary at 1.16.1. Compare the installed build with that boundary before you change production.
Version check
Seen in 1.16.0 → 1.16.1
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-111755. EPSS is 0.47%. Act only if a listed version of follow-redirects sensitiveHeaders regex escaping is installed.
Which versions are affected?
Compare what you have installed with 1.16.0 → 1.16.1. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-185; CWE-200: Exposure of Sensitive Information. EPSS 0.47%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 20, 2026 · GitHub Advisory Database
Detected
### Summary follow-redirects 1.16.0 introduced the option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each t
Oct 20, 2026 · GitHub Advisory Database
Fix available
follow-redirects fixed in 1.16.1
Oct 20, 2026 · GitHub Advisory Database
Fix available
follow-redirects fixed in 1.16.1
Oct 20, 2026 · GitHub Advisory Database
Updated
### Summary follow-redirects 1.16.0 introduced the option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each t
Sources
- CVE.orgVulnerability recordCVE-2026-111755
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or
cve.org - FIRST EPSSExploitation probabilityCVE-2026-111755
30-day exploitation probability 0.47%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-8r9p-f939-6h3c
GitHub Advisory Database record mirrored by OSV.
github.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-8r9p-f939-6h3c
follow-redirects sensitiveHeaders regex escaping can expose credential headers
osv.dev - urlscan.ioThreat intelligenceCVE-2026-111755urlscan.io
References
Freshness
Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSOct 31, 2026
- urlscan.ioOct 31, 2026
- CVE.orgOct 21, 2026
- GitHub Advisory DatabaseOct 20, 2026
- OpenSSF OSV / OSV ScannerOct 20, 2026