CVE-2026-116689

The record

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

Affected packages

Related vulnerabilities

• CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. CWE-201
• CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. CWE-201
• CVE-2026-119564 Plausible Analytics Community Edition through 3.2.1 contains an information exposure… CWE-201
• CVE-2026-107268 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor… CWE-201
• CVE-2026-45049 Open Access Management (OpenAM) is an access management solution. CWE-201
• CVE-2026-48200 Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document… CWE-201
• CVE-2026-118083 Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. CWE-201
• CVE-2026-114173 The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data… CWE-201