{"id":"CVE-2026-111755","title":"follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering (CVE-2026…","summary":"A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containi…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-212","CWE-185","CWE-200"],"vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["hardened_images"],"patched":["hardened_images"],"published":"2026-10-19","updated":"2026-10-23","sourceUpdated":"2026-10-23T05:22:09+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111755.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111755.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-111755"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555733"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111755"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755"},{"url":"https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8"},{"url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"},{"url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"},{"url":"https://access.redhat.com/errata/RHSA-2026:88478"},{"url":"https://access.redhat.com/errata/RHSA-2026:88537"},{"url":"https://access.redhat.com/errata/RHSA-2026:88541"},{"url":"https://github.com/advisories/GHSA-8r9p-f939-6h3c"}],"tags":["csaf","vex","red-hat","ghsa","npm","cve.org","exploit-available","score-dispute"],"epss":0.00471,"epssPercentile":0.40573,"aliases":["GHSA-8r9p-f939-6h3c"],"ecosystem":"npm","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-19T17:59:27.677540Z"},"scores":{"vendor":5.9,"cna":8.2},"ingestedAt":"2026-10-19T18:35:50.153Z","slug":"CVE-2026-111755","body":"## Overview\n\nA flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containing special regular expression characters, the library fails to properly escape them when building its header filtering logic. Consequently, the protection mechanism fails to strip the sensitive headers, forwarding sensitive authentication data to third-party redirect destinations.\n\n## Vendor advisories\n\n- **RHSA-2026:88478** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88478)\n- **RHSA-2026:88537** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88537)\n- **RHSA-2026:88541** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88541)\n- **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111755.json)\n\n**follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering** — rated Moderate by Red Hat. Released 2026-10-19, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Hardened Images\n\nFixed:\n\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat Hardened Images\n\nNot affected:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88478\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88537\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88541\n\n## Package advisory (CVE-2026-111755)\n\nAffected packages:\n\n- `follow-redirects >= 1.16.0, < 1.16.1`\n\nPatched in:\n\n- `follow-redirects 1.16.1`\n\nSource: https://github.com/advisories/GHSA-8r9p-f939-6h3c","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":228159,"id":"CVE-2026-111755","ts":1792758137996,"field":"cvss","old":"8.2","new":"5.9"},{"seq":228158,"id":"CVE-2026-111755","ts":1792758137996,"field":"severity","old":"high","new":"medium"}]}