Log in Start free

Vulnerability · Published Oct 27, 2026 · Assigned by GitHub_M

CVE-2026-116689follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

Medium 5.9

In plain English

A medium-severity security flaw in follow-redirects from follow-redirects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 81.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-follow-redirectsno fix listedDEBIAN-CVE-2026-116689
Debian:13node-follow-redirectsno fix listedDEBIAN-CVE-2026-116689
Debian:14node-follow-redirectsno fix listedDEBIAN-CVE-2026-116689
Ubuntu:26.10node-follow-redirectsno fix listedUBUNTU-CVE-2026-116689
npmfollow-redirects1.16.2GHSA-mrwp-f3q8-3g9p

Affected products (as reported)

VendorProductVersions
follow-redirects follow-redirects >= 1.16.0, < 1.16.2

Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References