CVE-2026-116689

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-201"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116689.json"
}

References

Affected packages

Git / github.com/follow-redirects/follow-redirects

Affected ranges

Type

GIT

Repo

https://github.com/follow-redirects/follow-redirects

Events

Introduced

0c23a223067201c368035e82954c11eb2578a33b

Fixed

e3b45a7a104fd84ab8e8914c78e9df4b930c1651

Fixed

b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.16.0"
                },
                {
                    "fixed":  "1.16.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.16.2",
            "range":  [
                {
                    "fixed":  "e3b45a7a104fd84ab8e8914c78e9df4b930c1651"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*

v1.16.0

v1.16.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116689.json"