UBUNTU-CVE-2026-116689

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-116689

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116689.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-116689

Upstream

CVE-2026-116689

Published

2026-10-27T20:17:00Z

Modified

2026-10-28T20:17:45Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

References

Affected packages

Ubuntu:26.10

node-follow-redirects

Package

Name: node-follow-redirects
Purl: pkg:deb/ubuntu/node-follow-redirects?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.15.11+~1.14.4-1build1

1.16.0+~1.14.4-2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-follow-redirects",
            "binary_version":  "1.16.0+~1.14.4-2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116689.json"

Ubuntu:Pro:18.04:LTS

node-follow-redirects

Package

Name: node-follow-redirects
Purl: pkg:deb/ubuntu/node-follow-redirects?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.4-1

1.2.4-1ubuntu0.18.04.1~esm1

1.2.4-1ubuntu0.18.04.1~esm2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-follow-redirects",
            "binary_version":  "1.2.4-1ubuntu0.18.04.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116689.json"

Ubuntu:Pro:20.04:LTS

node-follow-redirects

Package

Name: node-follow-redirects
Purl: pkg:deb/ubuntu/node-follow-redirects?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.4-1

1.2.4-1ubuntu0.20.04.1~esm1

1.2.4-1ubuntu0.20.04.1~esm2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-follow-redirects",
            "binary_version":  "1.2.4-1ubuntu0.20.04.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116689.json"

Ubuntu:Pro:22.04:LTS

node-follow-redirects

Package

Name: node-follow-redirects
Purl: pkg:deb/ubuntu/node-follow-redirects?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.13.1-1

1.14.5-1

1.14.7+~1.13.1-1

1.14.8+~1.14.0-1

1.14.9+~1.14.1-1

1.14.9+~1.14.1-1ubuntu0.1~esm1

1.14.9+~1.14.1-1ubuntu0.1~esm2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-follow-redirects",
            "binary_version":  "1.14.9+~1.14.1-1ubuntu0.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116689.json"

Ubuntu:Pro:24.04:LTS

node-follow-redirects

Package

Name: node-follow-redirects
Purl: pkg:deb/ubuntu/node-follow-redirects?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.15.2+~1.14.1-1

1.15.3+~1.14.2-1

1.15.6+~1.14.4-1

1.15.6+~1.14.4-1ubuntu0.1~esm1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-follow-redirects",
            "binary_version":  "1.15.6+~1.14.4-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116689.json"

Ubuntu:Pro:26.04:LTS

node-follow-redirects

Package

Name: node-follow-redirects
Purl: pkg:deb/ubuntu/node-follow-redirects?arch=source&distro=esm-apps%2Fresolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.15.9+~1.14.4-1

1.15.11+~1.14.4-1build1

1.15.11+~1.14.4-1ubuntu0.1~esm1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "node-follow-redirects",
            "binary_version":  "1.15.11+~1.14.4-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116689.json"