Key points
- CVE-2026-111755 affects follow-redirects versions 1.16.0 up to 1.16.1.
- Custom credential headers containing carets or pipes bypass the protection filter.
- Version 1.16.1 fixes the escapeRegex function to prevent the leak.
The follow-redirects package for Node.js, versions 1.16.0 up to 1.16.1, contains a high-severity vulnerability designated as CVE-2026-111755. This flaw allows sensitive headers to leak during cross-origin redirects when specific characters are present in the header name. The issue is fixed in version 1.16.1, which corrects the underlying regular expression logic.
In plain English
The follow-redirects library helps Node.js applications automatically handle HTTP redirects. Version 1.16.0 added a feature called sensitiveHeaders, which lets developers specify extra header names that should be stripped before following a redirect to a different host or downgrading from HTTPS to HTTP. The library builds a single regular expression filter to identify and remove these headers. However, the function used to escape the header names for this filter fails to handle certain special characters correctly.
The background
According to GitHub advisory GHSA-8r9p-f939-6h3c, the escapeRegex function leaves the caret (^) and pipe (|) characters unescaped. These characters are valid in HTTP header names under RFC 9110. When a developer declares a sensitive header containing either character, the generated regular expression pattern becomes invalid for matching that specific header. Consequently, the filter fails to recognize the header as sensitive. The application then forwards the credential to the redirect target without error or warning.
What changes now
Version 1.16.1 of follow-redirects fixes the escapeRegex function to properly handle the previously unescaped metacharacters. This update ensures that the sensitiveHeaders filter correctly matches and removes headers containing carets or pipes during cross-origin or protocol-downgrade redirects. The built-in protected headers, such as Authorization and Cookie, are not affected by this defect because they do not contain these special characters.
Who needs to act first
Security operations teams should prioritize updating systems that use custom credential headers with special characters. Check application logs for recent cross-origin redirects to identify potential exposure. Teams usually isolate affected services before applying patches to prevent service disruption. Verify the fix in a staging environment to ensure the new filter logic does not break existing integrations. Monitor for any unexpected header removal behavior after deployment.
What to do and how to stay safe: follow-redirects
- Audit Node.js applications using follow-redirects versions 1.16.0 up to 1.16.1 for custom sensitive headers containing carets or pipes.
- Upgrade to follow-redirects version 1.16.1 as soon as possible to restore proper header filtering during redirects.
- Review application configurations to ensure sensitive headers are correctly declared in the sensitiveHeaders option.
- Monitor server logs for unauthorized access attempts that may indicate prior credential leakage.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of follow-redirects are vulnerable to CVE-2026-111755?
Versions 1.16.0 up to 1.16.1 are vulnerable. The issue is fixed in version 1.16.1.
Why do headers with carets or pipes leak during redirects?
The escapeRegex function failed to escape these characters, causing the regular expression filter to miss matching the header name.
Are built-in headers like Authorization affected by this flaw?
No, the built-in list of sensitive headers does not contain carets or pipes, so they are not affected by this defect.
