Source: node-follow-redirects Version: 1.16.0+~1.14.4-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for node-follow-redirects. CVE-2026-111755[0]: | follow-redirects is a Node.js HTTP and HTTPS client wrapper that | automatically follows redirects. From 1.16.0 until 1.16.1, | escapeRegex leaves valid header-name metacharacters unescaped in | sensitiveHeaders. When an application declares a sensitive header | whose name contains ^ or | and follows a cross-origin or HTTPS-to- | HTTP redirect, unescaped regular-expression metacharacters prevent | the generated filter from matching the declared header name, and the | credential header is forwarded to an attacker-controlled redirect | target. This issue is fixed in version 1.16.1. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-111755 https://www.cve.org/CVERecord?id=CVE-2026-111755 [1] https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c [2] https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8 Please adjust the affected versions in the BTS as needed. Regards, Salvatore -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
