CVE-2026-111755
follow-redirects sensitiveHeaders regex escaping can expose credential headers
Reported by github_m · Published October 19, 2026
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| gitlab-rails-ce-19.4 | Chainguard | 19.4.3-r1 |
| nextcloud-server-33 | Wolfi | 33.0.10-r3 |
| kibana-9.4 | Chainguard | 9.4.8-r1 |
| kibana-9.5 | Chainguard | 9.5.5-r2 |
| langfuse-fips-4 | Chainguard | 4.68.0-r0 |
| code-server | Wolfi | 4.141.0-r3 |
| kibana-9.3 | Chainguard | 9.3.8-r8 |
| opensearch-dashboards-3-fips | Chainguard | 3.9.0-r1 |
| wazuh-dashboard-fips | Chainguard | 4.14.9-r2 |
| kibana-8.19 | Chainguard | 8.19.23-r4 |
| prism | Chainguard | 5.16.0-r17 |
| azurite | Chainguard | 3.37.0-r7 |
4 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| follow-redirects | follow-redirects | >= 1.16.0, < 1.16.1 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| wolfi | nextcloud-server-33 | 0 |
| chainguard | kibana-9.4 | 0 |
| chainguard | kibana-9.5 | 0 |
| chainguard | langfuse-fips-4 | 0 |
| wolfi | code-server | 0 |
| chainguard | kibana-9.3 | 0 |
| npm | follow-redirects | |
| chainguard | opensearch-dashboards-3-fips | 0 |
| chainguard | wazuh-dashboard-fips | 0 |
| chainguard | kibana-8.19 | 0 |
| chainguard | prism | 0 |
| chainguard | azurite | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.1 | 0 |
| chainguard | unleash-fips | 0 |
| wolfi | kubeflow-pipelines | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| follow-redirects | follow-redirects | 1.16.0 |
| chainguard | configurable-http-proxy | 0 |
…and 24 more
Timeline
- Oct 19, 2026 CVE Published
- Oct 19, 2026 CVE Updated
- Oct 20, 2026 EPSS Score (5 in total, the first dated here)
- Oct 30, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-111755
vulnetix vdb fixes CVE-2026-111755Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-111755/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c x_refsource_CONFIRM
- https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8 x_refsource_MISC
- https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-111755 advisory
- https://github.com/advisories/GHSA-8r9p-f939-6h3c advisory