CVE-2026-111755Medium· 5.9▾ TwilightPoC availableA flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
Last analysed / modified upstream
8.2 → 5.9
high → medium
0.4% → 0.5%
A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containing special regular expression characters, the library fails to properly escape them when building its header filtering logic. Consequently, the protection mechanism fails to strip the sensitive headers, forwarding sensitive authentication data to third-party redirect destinations.
follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering — rated Moderate by Red Hat. Released 2026-10-19, updated 2026-10-23.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88478 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88537 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:88541
Affected packages:
follow-redirects >= 1.16.0, < 1.16.1Patched in:
follow-redirects 1.16.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111756High· 7.5follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects (CVE-2026-111756)
CVE-2026-114126High· 8.8storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token (CVE-2026-114126)
CVE-2026-114125High· 8.8storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions (CVE-2026-114125)
CVE-2026-13697High· 7.4undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)
CVE-2026-69153High· 7.5postcss: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)
CVE-2026-101356Medium· 5.3tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing (CVE-2026-101356)