follow-redirects: Sensitive header disclosure via cross-realm array validation (CVE-2026-116689)
The follow-redirects package (versions 1.16.0 - 1.16.1) fails to identify sensitive header arrays created in isolated JavaScript realms, leading to the accidental forwarding of sensitive credentials to attacker-controlled redirect destinations.
CVE search metadata
CVE search record: CVE-2026-116689. KEV: no. Product: follow-redirects (>= 1.16.0, <= 1.16.1). Brief: follow-redirects: Sensitive header disclosure via cross-realm array validation (CVE-2026-116689). Brief link: https://feed.craftedsignal.io/briefs/2026-10-follow-redirects-sensitive-header-disclosure/
Triage facts
Revision 1- Applicability
- follow-redirects (>= 1.16.0, <= 1.16.1)
- Evidence
- Not observed
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 31, 03:20 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Roughly even chance
The follow-redirects library validates the sensitiveHeaders option using instanceof Array. This check fails when an array is instantiated within a separate JavaScript realm (e.g., node:vm). In such cases, the library silently resets the sensitiveHeaders to an empty list. Consequently, custom headers listed in the array - such as API keys or service tokens - are not scrubbed and are forwarded during cross-origin redirects. Built-in headers including Authorization, Proxy-Authorization, and Cookie are not affected.