Read the docs
TI-2026-81522 Aliases CVE-2026-116689GHSA-mrwp-f3q8-3g9p

Credential headers forwarded on redirects in follow-redirects

Priority MEDIUM 60CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-201.

Summary

follow-redirects, an npm package that wraps Node.js HTTP and HTTPS clients, is affected from 1.16.0 before 1.16.2. Its sensitiveHeaders check uses instanceof Array, so an array created in a different JavaScript context is replaced with an empty list (CWE-201). A remote attacker who controls a cross-origin redirect target can receive a custom credential header that was meant to be stripped.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00266 18th percentileScored 2026-11-07
Fix Partial follow-redirects (follow-redirects): 1.16.2follow-redirects (npm): 1.16.2Red Hat: 4 advisoriesRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
follow-redirectsfollow-redirects1.16.0 to before 1.16.21.16.2Patch availableCNA
—follow-redirects (npm)1.16.0 to before 1.16.21.16.2Patch availableGHSA-mrwp-f3q8-3g9p
  • follow-redirects Vendorfollow-redirects Affected 1.16.0 to before 1.16.2 Fixed in 1.16.2 Patch available CNA
  • follow-redirects (npm) Vendor— Affected 1.16.0 to before 1.16.2 Fixed in 1.16.2 Patch available GHSA-mrwp-f3q8-3g9p

Remediation

Update follow-redirects to version 1.16.2 or later. Red Hat Hardened Images is fixed by RHSA-2026:94794, RHSA-2026:93608, RHSA-2026:93605 and RHSA-2026:93601, and Red Hat lists it as affected with no fix planned in its affected product list.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA follow-redirects (follow-redirects) Fixed in 1.16.2
  • Fix · GHSA-mrwp-f3q8-3g9p follow-redirects (npm) Fixed in 1.16.2 Advisory →

Red Hat 4 advisories

  • RHSA-2026:94794 Released 2026-11-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.4-0.6.hum1@aarch64, grafana13.2-13.2.4-0.6.hum1@s390x, grafana13.2-13.2.4-0.6.hum1@src +1
  • RHSA-2026:93608 Released 2026-11-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.8-0.6.hum1@aarch64, grafana13.1-13.1.8-0.6.hum1@s390x, grafana13.1-13.1.8-0.6.hum1@src +1
  • RHSA-2026:93605 Released 2026-11-02 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images prometheus3.13-3.13.5-0.3.hum1@aarch64, prometheus3.13-3.13.5-0.3.hum1@src, prometheus3.13-3.13.5-0.3.hum1@x86_64
Show 1 more Red Hat advisories
  • RHSA-2026:93601 Released 2026-11-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.13-0.6.hum1@aarch64, grafana12.4-12.4.13-0.6.hum1@src, grafana12.4-12.4.13-0.6.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat Hardened ImagesFixed RHSA-2026:93601, RHSA-2026:93605, RHSA-2026:93608, RHSA-2026:94794

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-116689
  2. 2026-10-28 Priority changed: MEDIUM → LOW
  3. 2026-10-29 Affected versions changed · Red Hat
  4. 2026-10-29 CVSS score added · Red Hat
  5. 2026-10-30 CISA SSVC decision points changed
  6. 2026-10-30 Priority changed: LOW → MEDIUM
  7. 2026-10-30 Alias added: GHSA-mrwp-f3q8-3g9p
  8. 2026-10-30 Fix available: npm/[email protected] · GHSA-mrwp-f3q8-3g9p
  9. 2026-10-30 CVSS score added · GHSA-mrwp-f3q8-3g9p
  10. 2026-10-30 Weakness changed · GHSA-mrwp-f3q8-3g9p
  11. 2026-10-30 5 new references · GHSA-mrwp-f3q8-3g9p
  12. 2026-11-03 Fix available: RHSA-2026:93608 · Red Hat
  13. 2026-11-03 Fix available: RHSA-2026:93601 · Red Hat
  14. 2026-11-03 Fix available: RHSA-2026:93605 · Red Hat
  15. 2026-11-03 Fix available: Red Hat Hardened Images · Red Hat
  16. 2026-11-04 Fix available: RHSA-2026:94794 · Red Hat
  17. 2026-11-04 Affected versions changed · Red Hat

References

Advisory 1

Other 4

  • TI-2026-76983 Credential headers leak across redirects in follow-redirects CVSS 4.0HIGH 8.2
  • TI-2026-76533 Regex escaping flaw in follow-redirects leaks credential headers CVSS 4.0HIGH 8.2
  • TI-2023-11383 Improper input validation in follow-redirects CVSS 3.1HIGH 7.3
  • TI-2024-19051 Proxy-Authorization header kept across hosts in follow-redirects CVSS 3.1MEDIUM 6.5
  • TI-2022-00097 Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects CVSS 3.1MEDIUM 6.5
  • TI-2026-29551 follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets CVSS 4.0MEDIUM 6.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences