follow-redirects · Vulnerability
cve-program · CVE-2026-116689
Publishedfollow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Read the publisher's advisoryeuvd · EUVD-2026-111363
Publishedfollow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Read the publisher's advisorynvd · CVE-2026-116689
Publishedfollow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Read the publisher's advisoryosv · GHSA-mrwp-f3q8-3g9p
Published### Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled cross-origin redirect destination. ### Details Affected versions The sensitiveHeaders option was introduced in 1.16.0. Published 1.16.0 and 1.16.1 both reproduced, giving a tested affected range of 1.16.0 through 1.16.1. The source checkout was pinned at revision 46301256333c90b7faac7aa126effe72ec16d16e; the exact npm 1.16.1 artifact reproduced independently. Root cause index.js resets options.sensitiveHeaders when its local isArray() helper returns false. That helper uses value instanceof Array, which depends on realm identity. The same file already uses Array.isArray(options.headers), which correctly recognizes arrays across realms. Suggested remediation Use Array.isArray(value) for sensitiveHeaders, then validate and normalize each member as a header-name string. Add same-realm and node:vm cross-realm tests for cross-origin redirects, including the array-form headers representation. Verify that custom sensitive names are removed while unrelated headers remain unchanged. Duplicate review The public advisory history contains other sensitive-header findings, including array-form headers and regular-expression handling, but focused repository searches found no report describing cross-realm validation as of 2026-10-25. A private or differently worded report may already exist. ### Proof of concept Start two loopback HTTP servers. The first returns a 302 redirect to the second. Send X-API-Key and list that name in sensitiveHeaders, then compare a normal array with a genuine cross-realm array created by: ```js const vm = require('node:vm'); const sensitiveHeaders = vm.runInNewContext(`['X-API-Key']`); ``` Observed against both source and the exact npm 1.16.1 package: - Same-realm ['X-API-Key']: the redirect target did not receive the key. - Cross-realm ['X-API-Key']: Array.isArray(value) was true, value instanceof Array was false, and the redirect target received X-API-Key. - An unrelated X-Harmless header remained present in both cases. The complete 3.5 KB loopback-only harness and raw JSON output are available privately. ### Impact custom credential disclosure. Exploitation requires a direct caller or wrapper that preserves a cross-realm sensitiveHeaders array, a custom credential listed in that option, and an attacker-controlled or compromised endpoint that returns a cross-origin redirect. The directly demonstrated result is disclosure of the custom header value, potentially exposing an API key or service token until revocation. Built-in Authorization, Proxy-Authorization, and Cookie protections remained effective. Exact Axios 1.20.0 with follow-redirects 1.16.1 did not reproduce because Axios normalized the array; this report does not claim that Axios is affected. No third-party service was tested.
Read the publisher's advisoryAffected versions, risk and source history
Exploitation and risk
Source statusCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2026-116689
Publishedfollow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
- Source published
- 27 Oct 2026 19:38:46 UTC
- Source modified
- 30 Oct 2026 18:47:54 UTC
- Saved here
- 30 Oct 2026 19:45:26 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
euvd · EUVD-2026-111363
Publishedfollow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaSc…
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Oct 27, 2026, 7:38:46 PM
dateUpdated: Oct 30, 2026, 6:47:54 PM
5 related source bulletins · separate from aliases
RHSA-2026:93601: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
CVE-2026-110289 · CVE-2026-115754 · CVE-2026-115897 · CVE-2026-116591 · CVE-2026-116689
RHSA-2026:94794: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
CVE-2026-110910 · CVE-2026-116591 · CVE-2026-116689
RHSA-2026:93608: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
CVE-2026-116591 · CVE-2026-116689
RHSA-2026:93605: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
CVE-2026-116689
openSUSE-SU-2026:12424-1: agama-web-ui-25+475.275dd4727-56.1 on GA media
CVE-2026-102277 · CVE-2026-110725 · CVE-2026-111181 · CVE-2026-111755 · CVE-2026-111756 · CVE-2026-115754 · CVE-2026-115897 · CVE-2026-116689 · CVE-2026-75899 · CVE-2026-84369 · CVE-2026-86472
- Source published
- Oct 27, 2026, 7:38:46 PM (timezone not stated)
- Source modified
- Oct 30, 2026, 6:47:54 PM (timezone not stated)
- Saved here
- 14 Nov 2026 06:07:48 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd · CVE-2026-116689
Publishedfollow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaSc…
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Deferred
Weakness classifications: CWE-201
Original publisher date fields
published: 2026-10-27T20:17:14.177
lastModified: 2026-10-30T19:18:14.490
- Source published
- 27 Oct 2026 20:17:14 UTC
- Source modified
- 30 Oct 2026 19:18:14 UTC
- Saved here
- 30 Oct 2026 23:47:40 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · [email protected] · Secondary · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
osv · GHSA-mrwp-f3q8-3g9p
Publishedfollow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
### Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled cross-origin redirect destination. ### Details Affected versions The sensitiveHeaders option was introduced in 1.16.0. Published 1.16.0 and 1.16.1 both reproduced, giving a tested affected range of 1.16.0 through 1.16.1. The source checkout was pinned at revision 46301256333c90b7faac7aa126effe72ec16d16e; the exact npm 1.16.1 artifact reproduced independently. Root cause index.js resets options.sensitiveHeaders when its local isArray() helper returns false. That helper uses value instanceof Array, which depends on realm identity. The same file already uses Array.isArray(options.headers), which correctly recognizes arrays across realms. Suggested remediation Use Array.isArray(value) for sensitiveHeaders, then validate and normalize each member as a header-name string. Add same-realm and node:vm cross-realm tests for cross-origin redirects, including the array-form headers representation. Verify that custom sensitive names are removed while unrelated headers remain unchanged. Duplicate review The public advisory history contains other sensitive-header findings, including array-form headers and regular-expression handling, but focused repository searches found no report describing cross-realm validation as of 2026-10-25. A private or differently worded report may already exist. ### Proof of concept Start two loopback HTTP servers. The first returns a 302 redirect to the second. Send X-API-Key and list that name in sensitiveHeaders, then compare a normal array with a genuine cross-realm array created by: ```js const vm = require('node:vm'); const sensitiveHeaders = vm.runInNewContext(`['X-API-Key']`); ``` Observed against both source and the exact npm 1.16.1 package: - Same-realm ['X-API-Key']: the redirect target did not receive the key. - Cross-realm ['X-API-Key']: Array.isArray(value) was true, value instanceof Array was false, and the redirect target received X-API-Key. - An unrelated X-Harmless header remained present in both cases. The complete 3.5 KB loopback-only harness and raw JSON output are available privately. ### Impact custom credential disclosure. Exploitation requires a direct caller or wrapper that preserves a cross-realm sensitiveHeaders array, a custom credential listed in that option, and an attacker-controlled or compromised endpoint that returns a cross-origin redirect. The directly demonstrated result is disclosure of the custom header value, potentially exposing an API key or service token until revocation. Built-in Authorization, Proxy-Authorization, and Cookie protections remained effective. Exact Axios 1.20.0 with follow-redirects 1.16.1 did not reproduce because Axios normalized the array; this report does not claim that Axios is affected. No third-party service was tested.
- Source published
- 30 Oct 2026 22:59:33 UTC
- Source modified
- 30 Oct 2026 23:15:06 UTC
- Saved here
- 30 Oct 2026 23:45:44 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Publisher rating · HIGH