CVE-2026-111755
CVE-2026-111755 is a high-severity vulnerability with a CVSS 4.0 base score of 8.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-185.
Key facts
- Severity: High (CVSS 4.0 base score 8.2)
- EPSS exploit prediction: 0% (37th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-185
- Published:
- Last modified:
Description
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.
Frequently asked questions
- What is CVE-2026-111755?
- follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.
- How severe is CVE-2026-111755?
- CVE-2026-111755 has a CVSS 4.0 base score of 8.2, rated high severity.
- Is CVE-2026-111755 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-111755?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-111755 published?
- CVE-2026-111755 was published on 2026-10-19.
References
- https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8
- https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c
Other CWE-185 vulnerabilities
- CVE-2026-111057 — Critical (CVSS 10.0): Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4,…
- CVE-2024-52289 — Critical (CVSS 9.8): authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx…
- CVE-2019-12798 — Critical (CVSS 9.8): An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size,…
- CVE-2026-25896 — Critical (CVSS 9.3): fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based…
- CVE-2026-4296 — High (CVSS 8.8): An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to…
- CVE-2018-17984 — High (CVSS 7.8): An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files,…