Skip to content
fr Sign in
5.9 Medium

CVE-2026-116689 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects

Description

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

Affected products and versions

Product Affected versions Fixed in
follow-redirects 1.16 1.16.0 → < 1.16.2 1.16.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of follow-redirects

The 5 CVEs of follow-redirects →
CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects 8.2 High CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects 8.2 High CVE-2026-40895 follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows… 6.9 Medium CVE-2024-28849 follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows… 6.5 Medium
Track this CVE