[pkg-vuln] CVE-2026-116689 in follow-redirects@1.16.1 #1443

New Issue

kert · 2026-11-02T06:03:06Z

kert commented

2026-11-02 06:03:06 +00:00

Severity: HIGH
Package: follow-redirects @ 1.16.1
Fixed in: 1.16.2

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. T

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-116689

**Severity:** HIGH **Package:** `follow-redirects` @ `1.16.1` **Fixed in:** `1.16.2` follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. T **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-116689

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-11-02 06:03:06 +00:00

kert added the quality ci labels 2026-11-02 06:03:06 +00:00

kert closed this issue

2026-11-03 04:18:26 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1443