{"id":"ghsa-ghsa-8r9p-f939-6h3c","seq":2428,"kind":"advisory","title":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","url":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","permalink":"https://vulnpulse.app/items/ghsa-ghsa-8r9p-f939-6h3c","summary":"影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1\nSummary follow-redirects 1.16.0 introduced the sensitiveHeaders option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each through escapeRegex. escapeRegex escapes only a partial set of metacharacters and leave…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-111755"],"tags":["GHSA-8r9p-f939-6h3c","follow-redirects"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T17:53:05.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}