CVE-2026-111755
Fixed in a distro release EPSS <1%CVSS 8.2
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.
Products: follow-redirects
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | follow-redirects | 1.16.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | azurite | 3.37.0-r7 |
| Chainguard | code-server | 4.141.0-r3 |
| Chainguard | code-server | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | configurable-http-proxy | 5.3.0-r3 |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.9-r0 |
| Chainguard | gitlab-rails-ce-19.2 | no fix |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.6-r0 |
| Chainguard | gitlab-rails-ce-19.4 | 19.4.3-r1 |
| Chainguard | gitlab-rails-ce-19.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.2 | no fix |
| Chainguard | homepage | 2.6.0-r1 |
| Chainguard | kibana-8.19 | 8.19.23-r4 |
| Chainguard | kibana-8.19-bitnami | 8.19.23-r4 |
| Chainguard | kibana-9.3 | 9.3.8-r8 |
| Chainguard | kibana-9.4 | 9.4.8-r1 |
| Chainguard | kibana-9.5 | 9.5.5-r2 |
| Chainguard | kubeflow-pipelines-frontend | 2.17.2-r13 |
| Chainguard | lambda-nodejs22 | 4.0.2-r6 |
| Chainguard | lambda-nodejs24 | 4.0.2-r6 |
| Chainguard | langfuse-3 | 3.225.12-r6 |
| Chainguard | langfuse-3-worker | 3.225.12-r6 |
| Chainguard | langfuse-4 | 4.68.0-r0 |
| Chainguard | langfuse-4-worker | 4.68.0-r0 |
| Chainguard | langfuse-fips-3 | 3.225.12-r5 |
| Chainguard | langfuse-fips-3-worker | 3.225.12-r5 |
| Chainguard | langfuse-fips-4 | 4.68.0-r0 |
| Chainguard | langfuse-fips-4-worker | 4.68.0-r0 |
| Chainguard | lerna | 10.1.1-r1 |
| Chainguard | nemo-skills | no fix |
| Chainguard | nextcloud-server-33 | 33.0.10-r3 |
| Chainguard | nextcloud-server-34 | 34.0.5-r2 |
| Chainguard | nextcloud-server-35 | 35.0.0-r9 |
| Chainguard | opensearch-dashboards-2 | 2.19.6-r33 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.6-r18 |
| Chainguard | opensearch-dashboards-3 | 3.9.0-r3 |
| Chainguard | opensearch-dashboards-3-fips | 3.9.0-r1 |
| Chainguard | prism | 5.16.0-r17 |
| Chainguard | redisinsight | 3.8.0-r12 |
| Chainguard | semaphore | 2.19.17-r1 |
| Chainguard | unleash | 8.2.1-r0 |
| Chainguard | unleash-fips | 8.2.0-r7 |
| Chainguard | unleash-fips | no fix |
| Chainguard | wazuh-dashboard | 4.14.9-r3 |
| Chainguard | wazuh-dashboard-alerting-dashboards-plugin | 4.14.9-r3 |
| Chainguard | wazuh-dashboard-alerting-dashboards-plugin-fips | 4.14.9-r2 |
| Chainguard | wazuh-dashboard-anomaly-detection-dashboards-plugin | 4.14.9-r3 |
| Chainguard | wazuh-dashboard-anomaly-detection-dashboards-plugin-fips | 4.14.9-r2 |
| Chainguard | wazuh-dashboard-dashboards-maps | 4.14.9-r3 |
| Chainguard | wazuh-dashboard-dashboards-maps-fips | 4.14.9-r2 |
| Chainguard | wazuh-dashboard-dashboards-notifications | 4.14.9-r3 |
| Chainguard | wazuh-dashboard-dashboards-notifications-fips | 4.14.9-r2 |
| Chainguard | wazuh-dashboard-dashboards-reporting | 4.14.9-r3 |
| Chainguard | wazuh-dashboard-dashboards-reporting-fips | 4.14.9-r2 |
| Chainguard | wazuh-dashboard-dashboards-visualizations | 4.14.9-r3 |
| Chainguard | wazuh-dashboard-dashboards-visualizations-fips | 4.14.9-r2 |
| Chainguard | wazuh-dashboard-fips | 4.14.9-r2 |
| Chainguard | wazuh-dashboard-index-management-dashboards-plugin | 4.14.9-r3 |
| Chainguard | wazuh-dashboard-index-management-dashboards-plugin-fips | 4.14.9-r2 |
| Chainguard | wazuh-dashboard-plugins | 4.14.9-r3 |
| Chainguard | wazuh-dashboard-plugins-fips | 4.14.9-r2 |
| Chainguard | wazuh-dashboard-security-plugin | 4.14.9-r3 |
| Chainguard | wazuh-dashboard-security-plugin-fips | 4.14.9-r2 |
| Debian 12 | node-follow-redirects | no fix |
| Debian 13 | node-follow-redirects | no fix |
| Debian 14 | node-follow-redirects | no fix |
| Ubuntu 26.10 | node-follow-redirects | no fix |
| Ubuntu Pro 18.04 LTS | node-follow-redirects | no fix |
| Ubuntu Pro 20.04 LTS | node-follow-redirects | no fix |
| Ubuntu Pro 22.04 LTS | node-follow-redirects | no fix |
| Ubuntu Pro 24.04 LTS | node-follow-redirects | no fix |
| Ubuntu Pro 26.04 LTS | node-follow-redirects | no fix |
| Wolfi | code-server | 4.141.0-r3 |
| Wolfi | code-server | no fix |
| Wolfi | configurable-http-proxy | 5.3.0-r3 |
| Wolfi | kubeflow-pipelines-frontend | 2.17.2-r13 |
| Wolfi | langfuse-3 | 3.225.12-r6 |
| Wolfi | langfuse-3-worker | 3.225.12-r6 |
| Wolfi | lerna | 10.1.1-r1 |
| Wolfi | nextcloud-server-33 | 33.0.10-r3 |
| Wolfi | opensearch-dashboards-3 | 3.9.0-r3 |
| Wolfi | prism | 5.16.0-r17 |