Node.js HTTP and HTTPS Client Wrapper Vulnerability in follow-redirects

CVE-2026-111755

What is CVE-2026-111755?

The follow-redirects library, a widely used HTTP and HTTPS client wrapper for Node.js, has a vulnerability in versions 1.16.0 to 1.16.1. This flaw arises from improper escaping of valid header-name metacharacters in sensitive headers. When applications declare a sensitive header containing characters like ^ or | and follow a redirect—especially across origins or from HTTPS to HTTP—unescaped metacharacters may prevent the filter from correctly matching the header name. Consequently, this can lead to the unintended forwarding of credentials to malicious redirect targets. This vulnerability was addressed in version 1.16.1.

References