CVE-2026-116689

Name of the Vulnerable Software and Affected Versions follow-redirects versions 1.16.0 through 1.16.1

Description The sensitiveHeaders option is validated using instanceof Array, which causes arrays created in different JavaScript realms to be treated as empty lists. This occurs despite Array.isArray correctly identifying them. Consequently, if a request follows a cross-origin redirect controlled by an attacker, custom credential headers specified in the discarded list may be forwarded to the destination.

Recommendations Update to version 1.16.2.