What’s Vulnerable › Vulnerabilities

CVE-2026-116689: follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-27 · updated 2026-10-30
• Weakness: CWE-201

Description

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

Affected products

• follow-redirects: from 1.16.0, < 1.16.2

References

• https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8
• https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2
• https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p
• https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p

Get alerted when CVE-2026-116689 or the next vulnerability affects your stack