IT SBIT Services
Schneeberger
DEEN
CVE tracker

follow-redirects: Credential header exposure in sensitiveHeaders handling

CVE-2026-111755High 8.2

← All vulnerabilities

Summary

follow-redirects is a Node.js library that automatically follows HTTP and HTTPS redirects. In versions 1.16.0 up to 1.16.1, the escapeRegex function does not escape the regex metacharacters ^ and |, so a sensitive header whose name contains one of these characters is not matched by the filter. If the application follows a cross-origin or HTTPS-to-HTTP redirect, the credential header can be forwarded to an attacker-controlled redirect target. The attack requires the application to declare such a sensitive header and to send requests that are redirected.

Affected

  • follow-redirects >= 1.16.0, < 1.16.1
  • Applications that declare custom sensitiveHeaders names containing ^ or |
  • Transitive use, e.g. through axios, which delegates redirect handling to follow-redirects

Fixed in

  • 1.16.1 (fix for this CVE, according to the vendor)
  • Note: third-party advisories state that 1.16.2 or later also addresses CVE-2026-116689, which affects 1.16.0 and 1.16.1. Confirm this in the upstream GHSA.

Workaround

Unknown. No vendor-documented workaround is available. Upgrading is the only documented fix.

Exploitation

  • Known exploited (CISA KEV): not found in the sources reviewed; treat as unverified
  • Public proof-of-concept material exists according to the advisory text and third-party sources
  • VulDB lists no known exploit, which conflicts with the PoC material
  • CISA SSVC: exploitation poc, automatable no, technical impact partial

Our recommendation

  • Inventory Node.js projects and lockfiles/SBOMs for follow-redirects, including transitive dependencies
  • Upgrade to 1.16.2 or later (at least 1.16.1); verify the fixed version in the upstream GHSA
  • Review applications that declare custom sensitiveHeaders with ^ or | and forward them through redirects to external endpoints
  • Prioritise axios-based services that call external APIs, webhooks or partner systems; otherwise use the normal patch cycle
  • Monitor outbound traffic for unexpected redirect targets receiving credentials

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:42.

Original description (NVD)

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed