CVE-2026-111755 follow-redirects CVE debrief

Who should care

Defenders responsible for applications using the follow-redirects library, particularly those with custom credential headers, should assess exposure and prioritize updates or compensating controls.

Why it matters

The follow-redirects library's sensitiveHeaders option is vulnerable to regex escaping issues, potentially exposing custom credential headers during cross-origin redirects. Defenders should prioritize verifying and updating library versions, assessing exposure, and implementing compensating controls.

• Potential silent exposure of custom credential headers during cross-origin redirects
• Defenders must verify and update follow-redirects library versions to prevent exposure
• Implementing compensating controls to protect sensitive headers may be necessary

Technical summary

The follow-redirects library's sensitiveHeaders option is vulnerable to regex escaping issues due to incomplete metacharacter escaping. This can lead to the exposure of custom credential headers during cross-origin redirects. The library's implementation concatenates declared header names into an alternation after passing each through `escapeRegex`, which only escapes a partial set of metacharacters. As a result, header names containing certain characters, such as '^' or '|', can bypass the protection and expose sensitive headers.

Defensive priority

Defenders should prioritize verifying and updating follow-redirects library versions, assessing exposure of custom credential headers, and implementing compensating controls.

Recommended defensive actions

• Verify and update follow-redirects library versions to 1.16.1 or later
• Assess exposure of custom credential headers in applications using follow-redirects
• Implement compensating controls to protect sensitive headers
• Review and update security configurations for affected systems
• Monitor for potential exploitation attempts
• Conduct thorough vulnerability assessments
• Track exceptions and retest remediated assets

Evidence notes

Evidence is based on the follow-redirects library's implementation of the sensitiveHeaders option and its regex escaping mechanism. The library's use of a partial set of metacharacters for escaping can lead to vulnerabilities in certain header names, such as those containing '^' or '|'. This can result in the exposure of custom credential headers during cross-origin redirects. Defenders should verify library versions, assess exposure, and implement compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.