Most recent entries from all

fkie_cve-2026-111755

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.

GHSA-8r9p-f939-6h3c — follow-redirects sensitiveHeaders regex escaping can expose credential headers

Affected: npm: follow-redirects

### Summary follow-redirects 1.16.0 introduced the `sensitiveHeaders` option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each through `escapeRegex`. `escapeRegex` escapes only a partial set of metacharacters and leaves `^`, `|`, `[`, `{`, and `}` unescaped. Header names may legitimately contain `^` and `|` (both are valid RFC 9110 token characters that Node accepts and sends), and for a declared name containing either, the generated pattern can never match the intended header. As a result, an application that adopts this option to protect a custom credential header, then follows an attacker-controlled cross-origin redirect, forwards that credential to the attacker with no error or warning, while believing it is protected. The failure is silent: the protection simply does not exist for the affected names. The built-in list (Authorization, Proxy-Authorization, Cookie) contains no metacharacters and is not affected by this defect.

### Details The filter is constructed once, in the `RedirectableRequest` constructor at `index.js:118-120`:

```js this._headerFilter = new RegExp("^(?:" + sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") + ")$", "i"); ```

`escap…

RHSA-2026:88478 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token

UBUNTU-CVE-2026-111755

Affected: Ubuntu:Pro:18.04:LTS: node-follow-redirects, Ubuntu:Pro:20.04:LTS: node-follow-redirects, Ubuntu:Pro:22.04:LTS: node-follow-redirects, Ubuntu:Pro:24.04:LTS: node-follow-redirects, Ubuntu:26.10: node-follow-redirects, Ubuntu:Pro:26.04:LTS: node-follow-redirects

(follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom ...)