MEDIUM 5.9 NVD
CVE-2026-116689
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders opti
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
References
- https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206
- https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g
This medium severity vulnerability with a CVSS score of 5.9 was published on 2026-10-27 via NVD.
vulnfeed aggregates 18943 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.