ZDF
Sign inSign up

Vulnerabilities

Security research · CVE-2026-116689

follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · follow-redirects: Cross-realm sensitiveHeaders arrays

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-116689. EPSS is 0.27%. Act only if a listed version of follow-redirects: Cross-realm sensitiveHeaders arrays is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (follow-redirects: Cross-realm sensitiveHeaders arrays).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.27%
Remediation
Version ranges on file
Affected products
npm follow-redirects

### Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled cross-origin redirect destination. ### Details Affected versions The sensitiveHeaders option was introduced in 1.16.0. Published 1.16.0 and 1.16.1 both reproduced, giving a tested affected range of 1.16.0 through 1.16.1. The source checkout was pinned at revision 46301256333c90b7faac7aa126effe72ec16d16e; the exact npm 1.16.1 artifact reproduced independently. Root cause index.js resets options.sensitiveHeaders when its local isArray() helper returns false. That helper uses value instanceof Array, which depends on realm identity. The same file already uses Array.isArray(options.headers), which correctly recognizes arrays across realms. Suggested remediation Use Array.isArray(value) for sensitiveHeaders, then validate and normalize each member as a header-name string. Add same-realm and node:vm cross-realm tests for cross-origin redirects, including the array-form headers representation. Verify that custom sensitive names are removed while unrelated headers remain unchanged. Duplicate review The public advisory history contains other sensitive-header findings, including array-form headers and regular-expression handling, but focused repository searches found no report describing cross-realm validation as of 2026-10-25. A private or differently worded report may already exist. ### Proof of concept Start two loopback HTTP servers. The first returns a 302 redirect to the second. Send X-API-Key and list that name in sensitiveHeaders, then compare a normal array with a genuine cross-realm array created by: Observed against both source and the exact npm 1.16.1 package: - Same-realm ['X-API-Key']: the redirect target did not receive the key. - Cross-realm ['X-API-Key']: Array.isArray(val

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm follow-redirects>= 1.16.0, <= 1.16.1

How to fix CVE-2026-116689

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-116689. EPSS is 0.27%. Act only if a listed version of follow-redirects: Cross-realm sensitiveHeaders arrays is installed.

Which versions are affected?

Compare what you have installed with >= 1.16.0, <= 1.16.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-201. EPSS 0.27%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ### Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled cross-origin redirect destination. ### Details Affected versions The sensitiveHeaders option was introduced

  2. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ### Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled cross-origin redirect destination. ### Details Affected versions The sensitiveHeaders option was introduced

Sources

  • CVE.orgVulnerability recordCVE-2026-116689

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-mrwp-f3q8-3g9p

    follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-116689

    follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled cross-origin redirect destination.

    advisories.gitlab.com

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseNov 3, 2026
  • GitHub Advisory DatabaseNov 3, 2026
  • CVE.orgOct 31, 2026