Follow-Redirects (>= 1.16.0, <= 1.16.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/follow-redirects--1.16.0--1.16.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 03:20:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgfollow-redirects: Sensitive header disclosure via cross-realm array validation (CVE-2026-116689)https://feed.craftedsignal.io/briefs/2026-10-follow-redirects-sensitive-header-disclosure/Sat, 31 Oct 2026 03:20:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-follow-redirects-sensitive-header-disclosure/The follow-redirects package (versions 1.16.0 - 1.16.1) fails to identify sensitive header arrays created in isolated JavaScript realms, leading to the accidental forwarding of sensitive credentials to attacker-controlled redirect destinations.The follow-redirects library validates the sensitiveHeaders option using instanceof Array. This check fails when an array is instantiated within a separate JavaScript realm (e.g., node:vm). In such cases, the library silently resets the sensitiveHeaders to an empty list. Consequently, custom headers listed in the array - such as API keys or service tokens - are not scrubbed and are forwarded during cross-origin redirects. Built-in headers including Authorization, Proxy-Authorization, and Cookie are not affected.

]]>highadvisory