p PatchFirst

CVE-2026-116689

CVE-2026-116689 · follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

This page contains facts from public vulnerability sources. Check the original advisory before updating.

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

CVSS 5.9 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • follow-redirects

    Versions
    • >= 1.16.0, < 1.16.2: Affected

    No fix published

  • node-follow-redirects Debian:12

    Versions
    • 1.15.11+~1.14.4-1
    • 1.15.11+~1.14.4-2
    • 1.15.2+~1.14.1-1
    • 1.15.3+~1.14.2-1
    • 1.15.6+~1.14.4-1
    • 1.15.6+~1.14.4-2
    • 1.15.9+~1.14.4-1
    • 1.16.0+~1.14.4-1
    • 1.16.0+~1.14.4-2
    • 1.16.1+~1.14.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Debian:13

    Versions
    • 1.15.11+~1.14.4-1
    • 1.15.11+~1.14.4-2
    • 1.15.9+~1.14.4-1
    • 1.16.0+~1.14.4-1
    • 1.16.0+~1.14.4-2
    • 1.16.1+~1.14.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Debian:14

    Versions
    • 1.15.11+~1.14.4-1
    • 1.15.11+~1.14.4-2
    • 1.15.9+~1.14.4-1
    • 1.16.0+~1.14.4-1
    • 1.16.0+~1.14.4-2
    • 1.16.1+~1.14.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Ubuntu:Pro:18.04:LTS

    Versions
    • 1.2.4-1
    • 1.2.4-1ubuntu0.18.04.1~esm1
    • 1.2.4-1ubuntu0.18.04.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Ubuntu:Pro:20.04:LTS

    Versions
    • 1.2.4-1
    • 1.2.4-1ubuntu0.20.04.1~esm1
    • 1.2.4-1ubuntu0.20.04.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Ubuntu:Pro:22.04:LTS

    Versions
    • 1.13.1-1
    • 1.14.5-1
    • 1.14.7+~1.13.1-1
    • 1.14.8+~1.14.0-1
    • 1.14.9+~1.14.1-1
    • 1.14.9+~1.14.1-1ubuntu0.1~esm1
    • 1.14.9+~1.14.1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Ubuntu:Pro:24.04:LTS

    Versions
    • 1.15.2+~1.14.1-1
    • 1.15.3+~1.14.2-1
    • 1.15.6+~1.14.4-1
    • 1.15.6+~1.14.4-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Ubuntu:26.10

    Versions
    • 1.15.11+~1.14.4-1build1
    • 1.16.0+~1.14.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Ubuntu:Pro:26.04:LTS

    Versions
    • 1.15.9+~1.14.4-1
    • 1.15.11+~1.14.4-1build1
    • 1.15.11+~1.14.4-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →