CVE-2026-111755 in follow-redirects
Summary
by MITRE • 10/19/2026
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in follow-redirects versions prior to 1.16.1 represents a critical security flaw within a widely used Node.js HTTP and HTTPS client wrapper that automatically handles URL redirections. The core of the issue lies in how the library processes sensitive headers during cross-origin or protocol-changing redirects, specifically when escaping regular expression metacharacters for header name filtering. In versions from 1.16.0 up to but not including 1.16.1, the escapeRegex function fails to properly sanitize specific characters such as caret (^) and pipe (|) within sensitive header names. These characters are valid in HTTP header fields according to RFC standards, yet their presence triggers a logic error where they remain unescaped when constructing the regular expression used to filter which headers should be stripped before forwarding requests to new targets.
This technical flaw has severe operational implications for application security and data integrity. When an application configures follow-redirects with sensitive headers that contain these specific metacharacters, such as Authorization or custom authentication tokens named with ^ or | in their keys, the resulting regular expression filter becomes malformed. Consequently, the pattern fails to match the declared header name correctly during a redirect scenario involving cross-origin navigation or a transition from HTTPS to HTTP. Because the filtering mechanism does not recognize the sensitive header due to this regex mismatch, the library inadvertently forwards these credentials to an attacker-controlled redirect target rather than stripping them as intended. This behavior effectively bypasses security controls designed to prevent credential leakage across different domains or insecure channels.
The impact of this vulnerability aligns with CWE-200: Information Exposure and CWE-798: Use of Hard-coded Credentials, although the root cause is technically a CWE-134: Use of Externally-Controlled Format String in Regular Expression context leading to improper input validation. From an offensive security perspective, this flaw can be leveraged via the MITRE ATT&CK technique T1539: Steal Web Session Cookie or more broadly under data exfiltration tactics where sensitive authentication material is transmitted to unauthorized third parties. Attackers could exploit this by crafting malicious URLs that trigger redirects through vulnerable endpoints configured with follow-redirects, thereby capturing high-value credentials such as API keys, session tokens, or authorization headers intended for protected resources but instead delivered to the attacker's server.
Mitigation strategies require immediate action from developers and security teams utilizing affected versions of the library. The primary remediation is to upgrade follow-redirects to version 1.16.1 or later, where the escapeRegex function has been corrected to properly handle all valid header-name metacharacters including ^ and |. For environments unable to update immediately due to dependency constraints, alternative mitigation involves avoiding the use of sensitive headers with names containing regex special characters during redirect-heavy workflows. Additionally, implementing strict Content Security Policy (CSP) directives and monitoring for unusual outbound traffic patterns can help detect potential exploitation attempts where credentials are being exfiltrated via HTTP redirects to external domains. Regular auditing of third-party dependencies and their version histories is essential to maintain a secure software supply chain against such logic-based vulnerabilities.