DEBIAN-CVE-2026-111755

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-111755
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111755.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-111755
Upstream
Published
2026-10-20T07:47:32Z
Modified
2026-10-20T08:00:06Z
Summary
[none]
Details

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.

References

Affected packages

Debian:12 / node-follow-redirects

Package

Name
node-follow-redirects
Purl
pkg:deb/debian/node-follow-redirects?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.15.2+~1.14.1-1
1.15.3+~1.14.2-1
1.15.6+~1.14.4-1
1.15.6+~1.14.4-2
1.15.9+~1.14.4-1
1.15.11+~1.14.4-1
1.15.11+~1.14.4-2
1.16.0+~1.14.4-1
1.16.0+~1.14.4-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111755.json"

Debian:13 / node-follow-redirects

Package

Name
node-follow-redirects
Purl
pkg:deb/debian/node-follow-redirects?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.15.9+~1.14.4-1
1.15.11+~1.14.4-1
1.15.11+~1.14.4-2
1.16.0+~1.14.4-1
1.16.0+~1.14.4-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111755.json"

Debian:14 / node-follow-redirects

Package

Name
node-follow-redirects
Purl
pkg:deb/debian/node-follow-redirects?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.15.9+~1.14.4-1
1.15.11+~1.14.4-1
1.15.11+~1.14.4-2
1.16.0+~1.14.4-1
1.16.0+~1.14.4-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-111755.json"