Hi,

The following vulnerability was published for node-follow-redirects.

CVE-2026-111755[0]:
| follow-redirects is a Node.js HTTP and HTTPS client wrapper that
| automatically follows redirects. From 1.16.0 until 1.16.1,
| escapeRegex leaves valid header-name metacharacters unescaped in
| sensitiveHeaders. When an application declares a sensitive header
| whose name contains ^ or | and follows a cross-origin or HTTPS-to-
| HTTP redirect, unescaped regular-expression metacharacters prevent
| the generated filter from matching the declared header name, and the
| credential header is forwarded to an attacker-controlled redirect
| target. This issue is fixed in version 1.16.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111755
https://www.cve.org/CVERecord?id=CVE-2026-111755
[1] https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c
[2] https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore