{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/follow-redirects--1.16.0--1.16.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-116689"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["follow-redirects (\u003e= 1.16.0, \u003c= 1.16.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003efollow-redirects\u003c/code\u003e library validates the \u003ccode\u003esensitiveHeaders\u003c/code\u003e option using \u003ccode\u003einstanceof Array\u003c/code\u003e. This check fails when an array is instantiated within a separate JavaScript realm (e.g., \u003ccode\u003enode:vm\u003c/code\u003e). In such cases, the library silently resets the \u003ccode\u003esensitiveHeaders\u003c/code\u003e to an empty list. Consequently, custom headers listed in the array - such as API keys or service tokens - are not scrubbed and are forwarded during cross-origin redirects. Built-in headers including \u003ccode\u003eAuthorization\u003c/code\u003e, \u003ccode\u003eProxy-Authorization\u003c/code\u003e, and \u003ccode\u003eCookie\u003c/code\u003e are not affected.\u003c/p\u003e\n","date_modified":"2026-10-31T03:20:31Z","date_published":"2026-10-31T03:20:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-follow-redirects-sensitive-header-disclosure/","summary":"The follow-redirects package (versions 1.16.0 - 1.16.1) fails to identify sensitive header arrays created in isolated JavaScript realms, leading to the accidental forwarding of sensitive credentials to attacker-controlled redirect destinations.","title":"follow-redirects: Sensitive header disclosure via cross-realm array validation (CVE-2026-116689)","url":"https://feed.craftedsignal.io/briefs/2026-10-follow-redirects-sensitive-header-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Follow-Redirects (\u003e= 1.16.0, \u003c= 1.16.1)","version":"https://jsonfeed.org/version/1.1"}