Description
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| follow-redirects | follow-redirects | >= 1.16.0, < 1.16.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-follow-redirects | 1.16.1+~1.14.4-1 | — |
| Debian 13 | node-follow-redirects | No fix yet | — |
| Debian 12 | node-follow-redirects | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-follow-redirects | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-follow-redirects | No fix yet | — |
| Ubuntu Pro 24.04 LTS | node-follow-redirects | No fix yet | — |
| Ubuntu Pro 22.04 LTS | node-follow-redirects | No fix yet | — |
| Ubuntu Pro 20.04 LTS | node-follow-redirects | No fix yet | — |
| Ubuntu Pro 18.04 LTS | node-follow-redirects | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.13-0.3.hum1 | RHSA-2026:88478 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.8-0.4.hum1 | RHSA-2026:88537 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.4-0.3.hum1 | RHSA-2026:88541 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-web-ui | 25+475.275dd4727-56.1 | openSUSE-SU-2026:12424-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.141.0-r3 | — |
| Wolfi rolling | configurable-http-proxy | 5.3.0-r3 | — |
| Wolfi rolling | kubeflow-pipelines-frontend | 2.17.2-r13 | — |
| Wolfi rolling | langfuse-3 +1 | 3.225.12-r6 | — |
| Wolfi rolling | lerna | 10.1.1-r1 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.10-r3 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.9.0-r3 | — |
| Wolfi rolling | prism | 5.16.0-r17 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | follow-redirects | >= 1.16.0, < 1.16.1 | 1.16.1 | GHSA-8r9p-f939-6h3c |
Advisories 4
- RHSA-2026:88541 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88537 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88478 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- openSUSE-SU-2026:12424-1 agama-web-ui-25+475.275dd4727-56.1 on GA media SUSE / openSUSE Security Updates · Nov 6, 2026