CVE-2026-116689
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
| CWE | CWE-201 |
| Vendor | follow-redirects |
| Product | follow-redirects |
| Published | Oct 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for follow-redirects follow-redirects
Be the first to know when new medium vulnerabilities affecting follow-redirects follow-redirects are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
follow-redirects / follow-redirects
>= 1.16.0, < 1.16.2
References
github.com: https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p github.com: https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8 github.com: https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2