Update Node.js follow-redirects to block CVE-2026-111755 credential leaks via regex escape flaw
A regex flaw in the Node.js follow-redirects package allows custom credential headers to leak during cross-origin redirects if header names contain specific characters.
Key points
- CVE-2026-111755 affects follow-redirects versions 1.16.0 through 1.16.1.
- The flaw stems from an incomplete escapeRegex function that leaves carets and pipes unescaped.
- Custom headers with these characters bypass the sensitiveHeaders filter during redirects.
The follow-redirects package for Node.js contains a high-severity flaw that exposes custom credential headers during cross-origin redirects. Applications using version 1.16.0 until 1.16.1 are vulnerable to this issue. The defect arises because the escapeRegex utility fails to escape specific metacharacters, allowing attackers to bypass header filtering mechanisms. This vulnerability is tracked as CVE-2026-111755.
The risk
The follow-redirects package introduced a sensitiveHeaders option in version 1.16.0 to protect credentials during redirects. This feature builds a regular expression filter by concatenating declared header names. However, the escapeRegex function only escapes a partial set of metacharacters. It leaves carets, pipes, square brackets, and curly braces unescaped. Header names containing carets or pipes are valid under RFC 9110 and accepted by Node.js. When such a header is declared as sensitive, the generated filter fails to match it. Consequently, the credential header is forwarded to attacker-controlled redirect targets without error or warning.
Who is exposed
Any Node.js application using follow-redirects version 1.16.0 or later but before 1.16.1 is exposed. The risk is highest for applications that define custom credential headers containing carets or pipes. These characters are valid HTTP token characters. The built-in protected headers like Authorization and Cookie do not contain these metacharacters and remain unaffected. Developers must check their dependency trees for vulnerable versions of the follow-redirects package.
Cost and compliance
The National Vulnerability Database rates CVE-2026-111755 as high severity with a CVSS score of 8.2. The flaw maps to CWE-185 for errors in regular expressions and CWE-200 for information exposure. No financial impact or specific compliance mandates are detailed in the advisory records. The primary cost is the potential leakage of sensitive authentication data to unauthorized parties.
Our take on the response
Vendors should immediately update to version 1.16.1, which fixes the escapeRegex function. Teams must audit their codebases for custom headers using carets or pipes. Relying solely on built-in header protection is insufficient if custom credentials are in use. This fix restores the intended security boundary for all declared sensitive headers.
What defenders should look for
Security operations teams should monitor for outbound HTTP requests containing custom credential headers. Look for redirects to unexpected external domains following authentication events. Check application logs for requests where sensitive headers are present despite redirect filters. Inspect network traffic for headers that should have been stripped. Verify that the follow-redirects package is updated to the patched version. Ensure that custom header names do not contain regex metacharacters that could bypass filtering. Review server access logs for anomalies in redirect patterns.
What to do and how to stay safe: follow-redirects
- Update the follow-redirects package to version 1.16.1 or later in all Node.js projects.
- Audit application code for custom headers containing carets or pipes and rename them if possible.
- Monitor network logs for credential headers appearing in requests to external domains.
- Verify that sensitiveHeaders configurations are correctly applied and tested with edge-case header names.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of follow-redirects are vulnerable to CVE-2026-111755?
Versions 1.16.0 and later, up to but not including 1.16.1, are vulnerable to this flaw.
Does this affect standard headers like Authorization?
No, standard headers like Authorization, Proxy-Authorization, and Cookie do not contain the affected metacharacters.
What characters cause the header filter to fail?
Header names containing carets or pipes bypass the filter because they are not escaped by the regex function.
