5.9
Moyenne
CVE-2026-116689 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects
Description
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| follow-redirects 1.16 | 1.16.0 → < 1.16.2 | 1.16.2 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de follow-redirects
Les 5 CVE de follow-redirects →
CVE-2026-111756
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects
8.2
Élevée
CVE-2026-111755
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects
8.2
Élevée
CVE-2026-40895
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows…
6.9
Moyenne
CVE-2024-28849
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows…
6.5
Moyenne