Homepage

Improper Cross-boundary Removal of Sensitive Data The advisory has been revoked - it doesn't affect any version of package prometheus3.13  (opens in a new tab)

Threat Intelligence

EPSS
0.44% (37th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PROMETHEUS313-21263929
  • published20 Oct 2026
  • disclosed19 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 19 Oct 2026

NewCVE-2026-111755  (opens in a new tab)
CWE-212  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream prometheus3.13 package and not the prometheus3.13 package as distributed by RHEL.

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.