CVE-2026-116689
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Risk Assessment
The vulnerability can lead to leakage of sensitive credential headers to an unauthorized destination, potentially resulting in account takeover or unauthorized access to protected resources.
Recommendation
Update the follow-redirects library to version 1.16.2 or later. It is also recommended to avoid passing sensitive headers across cross-origin redirects.
Other vulnerabilities in follow-redirects
See all- CVE-2026-111756High
A vulnerability in follow-redirects (versions 1.16.0 to before 1.16.1) causes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, sensitiveHeaders) not to be stripped when following a cross-host or protocol-downgrade redirect if the application supplied headers as an alternating array of names and values. The removal routine uses for...in, which yields numeric indices for arrays, so no header name matches the filter and nothing is removed. As a result, the application forwards credentials to an attacker-controlled destination without any error or warning.
- CVE-2026-111755High
follow-redirects versions 1.16.0 through 1.16.1 fail to escape regex metacharacters (^ or |) in sensitive header names. As a result, on cross-origin or HTTPS-to-HTTP redirects, the generated filter does not match the declared header and the credential header is forwarded to an attacker-controlled redirect target. The issue is fixed in version 1.16.1.
- CVE-2026-40895High
In the follow-redirects library for Node.js, a vulnerability was found where custom authentication headers (e.g., X-API-Key, X-Auth-Token) are not stripped during cross-domain redirects. An attacker could exploit this to intercept sensitive credentials.
Original NVD description (English source)
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS