Média · CVSS 5.9código aberto
GitHub AdvisoriesCVE-2026-116689
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
npm · follow-redirects
follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled cross-origin redirect destination.