CVE-2026-111755
Received Received - Intake

Remote Code Execution in follow-redirects Library

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111755
EUVD
EUVD-2026-104536

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
follow-redirects follow-redirects >= 1.16.0, < 1.16.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-185 The product specifies a regular expression in a way that causes data to be improperly matched or compared.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111755 is a vulnerability in the follow-redirects library (versions 1.16.0) where the escapeRegex function fails to properly escape certain regular-expression metacharacters (^ or |) in header names. This allows credential headers containing these characters to bypass cross-origin stripping during redirects, potentially exposing sensitive data to attacker-controlled redirect targets.

Detection Guidance

To detect this vulnerability, check if your system uses follow-redirects version 1.16.0. Run: npm list follow-redirects. If version 1.16.0 is installed, the system is vulnerable.

Impact Analysis

If you use follow-redirects version 1.16.0 with the sensitiveHeaders option and include headers with ^ or | in their names, credentials for those headers may be forwarded to unauthorized parties during cross-origin or HTTPS-to-HTML redirects. This could lead to silent information disclosure without warning.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data (e.g., authentication tokens, cookies), which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected versions risk non-compliance due to potential credential exposure during redirects.

Mitigation Strategies

Upgrade follow-redirects to version 1.16.1 or later. Run: npm update follow-redirects. If using a downstream library like axios, ensure it uses a patched version of follow-redirects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111755. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart