CVE-2026-116689
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects
- Risk score
- 45/100
- CVSS
- 5.9 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes …
- Affected
- See advisory
- Fix
- Upgrade the product to 1.16.2 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.9 medium
- On your watchlist: node.js
References
Original description
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Last activity 27 Oct 2026. Patch Forecast updates every hour.