npm/follow-redirects CVE-2026-111755: high 8.2
follow-redirects sensitiveHeaders regex escaping can expose credential headers
Action: Upgrade follow-redirects to 1.16.1 or later.
npm i follow-redirects@1.16.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.16.0 | 1.16.1 | - |
Fixed versions
| 1.16.1 |
Sources
- osv: GHSA-8r9p-f939-6h3c
- nvd: CVE-2026-111755
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c
- https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8
- https://github.com/follow-redirects/follow-redirects
- https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1
CVE-2026-111755 · published · modified · JSON