Your message dated Sat, 24 Oct 2026 20:42:31 +0000
with message-id <[email protected]>
and subject line Bug#1151930: fixed in node-follow-redirects 1.16.1+~1.14.4-1
has caused the Debian Bug report #1151930,
regarding node-follow-redirects: CVE-2026-111755
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151930: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151930
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-follow-redirects
Version: 1.16.0+~1.14.4-2
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for node-follow-redirects.
CVE-2026-111755[0]:
| follow-redirects is a Node.js HTTP and HTTPS client wrapper that
| automatically follows redirects. From 1.16.0 until 1.16.1,
| escapeRegex leaves valid header-name metacharacters unescaped in
| sensitiveHeaders. When an application declares a sensitive header
| whose name contains ^ or | and follows a cross-origin or HTTPS-to-
| HTTP redirect, unescaped regular-expression metacharacters prevent
| the generated filter from matching the declared header name, and the
| credential header is forwarded to an attacker-controlled redirect
| target. This issue is fixed in version 1.16.1.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-111755
https://www.cve.org/CVERecord?id=CVE-2026-111755
[1]
https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c
[2]
https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-follow-redirects
Source-Version: 1.16.1+~1.14.4-1
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-follow-redirects, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-follow-redirects
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Oct 2026 21:44:35 +0200
Source: node-follow-redirects
Architecture: source
Version: 1.16.1+~1.14.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1151930 1151931
Changes:
node-follow-redirects (1.16.1+~1.14.4-1) unstable; urgency=medium
.
* Team upload
* New upstream version
(Closes: #1151930, #1151931, CVE-2026-111755, CVE-2026-111756)
* Unfuzz patches
Checksums-Sha1:
f8856af50863a1e2f7da5ce00b50de38e044d452 2656
node-follow-redirects_1.16.1+~1.14.4-1.dsc
ca054d72ef574c77949fc5fff278b430fcd508ec 2813
node-follow-redirects_1.16.1+~1.14.4.orig-types-follow-redirects.tar.gz
45d2a482b9fbf37e0d1b61b2c6006ac8be719bca 94480
node-follow-redirects_1.16.1+~1.14.4.orig.tar.gz
c29478681c8fd11a404a685846235099f6756f77 5244
node-follow-redirects_1.16.1+~1.14.4-1.debian.tar.xz
Checksums-Sha256:
6999297567764fea8eb88d56e3cf833f03a297ad72efdbcfbb546041ed9d721c 2656
node-follow-redirects_1.16.1+~1.14.4-1.dsc
88b7ad41ccdd6b77b864f048a67b7141dea86841a382d22b8b91f6c28f73a7d8 2813
node-follow-redirects_1.16.1+~1.14.4.orig-types-follow-redirects.tar.gz
c4c29c70924490e319613e836e56bf116d2935490b1aed6331a5f9abfa0ba4de 94480
node-follow-redirects_1.16.1+~1.14.4.orig.tar.gz
5fba7bff04b938226ab303844f79527081b962764c6fc21105d5dd8aee104a95 5244
node-follow-redirects_1.16.1+~1.14.4-1.debian.tar.xz
Files:
c9c1a599b7871c92f0f89ae36fb06798 2656 javascript optional
node-follow-redirects_1.16.1+~1.14.4-1.dsc
719a7019d9e21269e285e4a7c45126dc 2813 javascript optional
node-follow-redirects_1.16.1+~1.14.4.orig-types-follow-redirects.tar.gz
36ce5eeb10a76f2433663e92f93d22eb 94480 javascript optional
node-follow-redirects_1.16.1+~1.14.4.orig.tar.gz
0f6cce569fa9ee8eab0861e4a16b2834 5244 javascript optional
node-follow-redirects_1.16.1+~1.14.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrdCyEACgkQ9tdMp8mZ
7un/yQ//fpwR3JEeduoBXaz/36D1BHThgRH4X+g79bdMvZVIXZ2ZsW5qKtav/6t8
ix4A/WgoXiv7OoWvjyCSt5e7Egw9As6MUROyaxrW6fNXcUw9/VDz/v92ZJ9D4Y4I
K6/kVrqiW3XBoSZkUmXmZCMXkkewPhy+s3spfXqEfEVC/tJZSD40c/pxIMn/T6uT
Xq5Hlv1WIwWuUoPRxH72+QeVEMwofIqsCNkREOWnd7b5f4j8KOrRUEoFQ7AVUU8v
Ov0KTvasuFet2TyqFC64BNxZpal6kiyyK+ejWlPWueaJ4CUrYe9TyKGR/C8CyBWL
hIRMP0E79qMQ+U5urVwDWYlLsMcBRaXVDujgxukwqZPr2WDLDfVsLYv6vHy4OFCh
Tf//9G4hRaIKY8koaqwKzpfnTuJCrOGBycJxENPEJyDwhduwf+PBqOaiO/DK8uo8
xg8t9G7CSgq7qMnfPItMgHpkCd1IPFWN5KL0egP8IHWsaIa0AqWl0c0G9G2Qfnvc
Cw7SQNtiwA/0LIgpCGblQL/lCM6VTwxYaNiLz0yP+h+JQQfPyAajU94jL8urMRMM
3YeSC1nQXc7khBiY2FMAqI8Cg0UaAauEdhttqZ8Jb2lAjSrtEdmmoPonwUUzemn3
3Zj9dZrhWoePklK9fNbNQFHPA6ru36GxrmDr7mpH9c/5y8jA8m4=
=KdEz
-----END PGP SIGNATURE-----
pgpQUJefXBl6U.pgp
Description: PGP signature
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
