Follow-Redirects (>= 1.16.0, <= 1.16.1)

The follow-redirects package (versions 1.16.0 - 1.16.1) fails to identify sensitive header arrays created in isolated JavaScript realms, leading to the accidental forwarding of sensitive credentials to attacker-controlled redirect destinations.