DEBIAN-CVE-2026-116689: Medium severity debian/node-follow-redirects vulnerability

Published Oct 27, 2026

Updated

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

Affected Software

3 affected components

debian/node-follow-redirects*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade follow-redirects to a version that resolves this vulnerability.
Fixed in 1.16.2

Event History

Oct 27, 2026

CVE Published

via OSV·08:17 PM

Data Sourced

via OSV·08:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are realistically exposed to credential leakage?

Applications using follow-redirects versions 1.16.0 through 1.16.2 are exposed when they pass sensitiveHeaders as an Array created in a different JavaScript realm and make requests that can be redirected cross-origin by an attacker. The affected header must contain custom credentials intended to be withheld on redirects.

What does an attacker need to exploit this issue?

An attacker needs to cause the client to follow a cross-origin redirect to a destination they control. Exploitation also depends on the application supplying sensitiveHeaders from another JavaScript realm, causing the configured credential-header protections to be discarded.

Are default deployments affected?

The issue depends on a specific non-default usage pattern: sensitiveHeaders must be configured with a cross-realm Array. Configurations that do not use sensitiveHeaders this way are not described as affected.

What should be done if upgrading cannot happen immediately?

Avoid passing sensitiveHeaders as an Array created in another JavaScript realm, and prevent requests containing custom credential headers from following untrusted cross-origin redirects. Upgrade to the fixed version, 1.16.2, when possible.

DEBIAN-CVE-2026-116689: Medium severity debian/node-follow-redirects vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are realistically exposed to credential leakage?

What does an attacker need to exploit this issue?

Are default deployments affected?

What should be done if upgrading cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed to credential leakage?

What does an attacker need to exploit this issue?

Are default deployments affected?

What should be done if upgrading cannot happen immediately?