Cross-Origin Credential Leakage in Follow-Redirects Node.js Client

CVE-2026-116689

What is CVE-2026-116689?

The Follow-Redirects library for Node.js, from versions 1.16.0 to 1.16.2, has a vulnerability that allows sensitive headers to be forwarded during cross-origin redirects. This occurs due to an improper check on the sensitiveHeaders option, which leads to the inadvertent handling of arrays created in different JavaScript realms. As a result, custom credential headers that were intended to be discarded may still be forwarded to attacker-controlled destinations during redirect processes. The issue has been addressed in version 1.16.2.

References