CVE-2026-111755

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a...

CVE-2026-111755

The follow-redirects Node.js HTTP and HTTPS client wrapper (versions 1.16.0 through 1.16.1 ) contains a vulnerability where escapeRegex fails to escape valid header-name metacharacters in sensitiveHeaders . If an application declares a sensitive header containing ^ or | and performs a cross-origi...

CVE-2026-111755 follow-redirects sensitiveHeaders regex escaping can expose credential headers

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a...

CVE-2026-111755 follow-redirects sensitiveHeaders regex escaping can expose credential headers

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a...

EUVD-2026-104536

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a...