[pkg-vuln] CVE-2026-116689 in follow-redirects@1.16.1 #1453

New Issue

kert · 2026-11-03T06:02:11Z

kert commented

2026-11-03 06:02:11 +00:00

Severity: HIGH
Package: follow-redirects @ 1.16.1
Fixed in: 1.16.2

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. T

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-116689

**Severity:** HIGH **Package:** `follow-redirects` @ `1.16.1` **Fixed in:** `1.16.2` follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. T **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-116689

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-11-03 06:02:11 +00:00

kert added the ci quality labels 2026-11-03 06:02:11 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1453