Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116689— follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

Quick assessment

Affected
follow-redirects follow-redirects
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个用于 Node.js 的 HTTP 和 HTTPS 客户端封装库，可自动跟随重定向。在 1.16.0 至 1.16.2 版本中，文档中描述的 选项通过 进行校验。这导致在另一个 JavaScript 执行域（realm）中创建的数组会被错误地替换为空列表，尽管 能够正确识别该数组。当请求随后跟随由攻击者控制的跨域重定向时，原本应被阻止的、在已丢弃列表中指定的自定义凭证头（credential header）可能会被转发到重定向目标地址。该问题已在版本 1.16.2 中修复。

CVSS 5.9 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
follow-redirects follow-redirects >= 1.16.0, < 1.16.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116689

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
Source: CVE Program / CVE List V5
Vulnerability Description
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过发送数据的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
follow-redirects follow-redirects >= 1.16.0, < 1.16.2 -

II. Public POCs for CVE-2026-116689

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116689

请登录查看更多情报信息。

Other References for CVE-2026-116689 (3)

IV. Related Vulnerabilities

Same product: follow-redirects
Same vendor: follow-redirects
Same weakness: CWE-201