Node.js follow-redirects 1.16.1 Fixes Credential Leakage in CVE-2026-111755

The Node.js library follow-redirects has released version 1.16.1 to address a high-severity vulnerability that exposes sensitive headers during HTTP redirects. Applications using version 1.16.0 are affected by this credential-leakage issue, which is tracked as CVE-2026-111755.

What happened

The National Vulnerability Database records CVE-2026-111755 with a CVSS score of 8.2, classifying it as high severity. The flaw exists in the follow-redirects library, a wrapper for Node.js HTTP and HTTPS clients that automatically follows redirects. According to the NVD description, the issue stems from the escapeRegex function in versions 1.16.0 until 1.16.1. This function leaves valid header-name metacharacters unescaped in sensitiveHeaders.

Specifically, if a sensitive header name contains the characters ^ or |, they remain unescaped. This oversight prevents the generated filter from matching the declared header name when an application follows a cross-origin or HTTPS-to-HTTP redirect. Consequently, the credential header is forwarded to an attacker-controlled redirect target. The NVD identifies the underlying weaknesses as CWE-185 and CWE-200.

Why it matters

This vulnerability compromises the confidentiality of sensitive data transmitted over HTTP connections. Developers who rely on follow-redirects to handle redirects automatically may inadvertently expose authentication tokens or other credentials. The risk is highest for applications that declare sensitive headers with names containing the specific metacharacters identified in the advisory. Because the library is widely used in Node.js ecosystems, many systems may be vulnerable by default if they are running version 1.16.0. The fix in version 1.16.1 corrects the regex escaping logic, ensuring that sensitive headers are properly filtered out during redirect sequences.

What to watch

• Monitor the NVD for any updates to the CVSS score or additional details about CVE-2026-111755.
• Watch for new advisories from the follow-redirects maintainers regarding further patches or related issues.
• Observe security mailing lists for reports of active exploitation of this credential-leakage flaw.
• Check your dependency graphs for any transitive dependencies that might pull in the affected version.

Who needs to act first

Teams should prioritize updating systems that handle user authentication or sensitive data transfers. Identify all Node.js applications using follow-redirects version 1.16.0 and schedule immediate updates to 1.16.1. Test the update in a staging environment to ensure compatibility with existing redirect logic. Verify that sensitive headers are no longer forwarded to external domains after the patch. If immediate updating is not possible, consider disabling automatic redirects for high-risk endpoints. Review logs for any unusual redirect patterns that might indicate exploitation. Ensure that your deployment process includes checks for known vulnerable package versions.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: follow-redirects

• Audit your Node.js projects to identify any usage of follow-redirects version 1.16.0.
• Update the library to version 1.16.1 once you have verified compatibility with your application.
• Review your sensitiveHeaders configuration to ensure header names do not contain unescaped metacharacters.
• Monitor network traffic for unexpected credential transmissions to external redirect targets.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of follow-redirects are affected by CVE-2026-111755?

Versions 1.16.0 until 1.16.1 are affected by this vulnerability.

Is there a fix available for CVE-2026-111755?

Yes, the issue is fixed in version 1.16.1 of the follow-redirects library.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-111755 with a CVSS score of 8.2, which is high severity.