## follow-redirects sensitiveHeaders regex escaping can expose credential headers

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-111755
- 公開日時: 2026-10-20T17:53:05.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-8r9p-f939-6h3c)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-8r9p-f939-6h3c

影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1
Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each through escapeRegex. escapeRegex escapes only a partial set of metacharacters and leave…