CVE-2026-116689: follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
follow-redirectsto a version that resolves this vulnerability.Fixed in 1.16.2
Event History
Frequently Asked Questions
What conditions are required for credential exposure?
The application must supply sensitiveHeaders as an array created in another JavaScript realm, include a custom credential header in that list, and follow an attacker-controlled cross-origin redirect. Under those conditions, the header can be forwarded to the redirect destination.
Are applications using the documented sensitiveHeaders option automatically protected?
Not if the option is passed as an array from another JavaScript realm. The affected check discards that array, leaving the custom headers it named unprotected during redirects.
What is the recommended remediation?
Upgrade follow-redirects to version 1.16.2, which fixes the issue.
How can I identify potentially affected usage?
Review use of follow-redirects from version 1.16.0 until the 1.16.2 fix, especially code that passes sensitiveHeaders across JavaScript realm boundaries and sends custom credential headers to endpoints that may redirect across origins.