Node.js follow-redirects CVE-2026-111755 Exposes Credentials in Redirects

The follow-redirects library for Node.js contains a credential leakage vulnerability identified as CVE-2026-111755. This flaw allows sensitive authentication headers to be forwarded to unintended destinations. Applications relying on automatic redirect handling between version 1.16.0 and 1.16.1 are exposed. The issue arises when specific header name patterns bypass internal filtering mechanisms.

Root cause

The vulnerability stems from how the library processes sensitive header declarations. The escapeRegex function fails to properly escape certain regular expression metacharacters. Specifically, the caret and pipe characters remain unescaped in the sensitiveHeaders configuration. This oversight means the generated filter does not match header names containing these symbols. Consequently, the library treats these headers as non-sensitive.

Attack path

An attacker must control a redirect target to exploit this flaw. The victim application must declare a sensitive header with a name containing a caret or pipe. When the application follows a cross-origin or HTTPS-to-HTTP redirect, the filter fails. The credential header is then included in the request to the attacker-controlled server. This allows the interception of authentication tokens or other sensitive data.

Affected versions

• follow-redirects version 1.16.0 is affected.
• Any version below 1.16.1 is vulnerable.
• Version 1.16.1 fixes the issue.

Mitigation

• Upgrade follow-redirects to version 1.16.1 immediately.
• Audit header names for special regex characters.
• Avoid using sensitive headers with complex names.
• Monitor for unexpected cross-origin redirect traffic.

Signals worth monitoring

Teams usually detect credential leakage by reviewing outbound traffic logs for sensitive headers sent to external domains. Check whether proxy logs show authentication tokens appearing in requests to untrusted hosts. Look for anomalies in redirect chains that terminate at unexpected IP addresses. Verify that internal services are not forwarding headers to public endpoints.

Investigate any sudden increase in external requests containing authorization data. Ensure that monitoring tools capture full header details during redirect sequences. Review network flows for HTTPS-to-HTTP downgrades that might strip security expectations. These behaviors often indicate misconfigured client libraries or exploited flaws.

What to do and how to stay safe: Node.js

• Scan your Node.js dependencies for follow-redirects version 1.16.0.
• Review application code for sensitive headers with special characters.
• Monitor outbound traffic for credential leakage to external hosts.
• Update libraries once the vendor provides a confirmed patch.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-111755?

It is a high-severity vulnerability in the follow-redirects Node.js library that causes credential leakage during redirects.

Which versions are affected?

Versions from 1.16.0 up to but not including 1.16.1 are affected.

Is there a fix available?

Yes, the issue is fixed in version 1.16.1.