CVE-2026-116689

About vulnerability

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

Affected product:

3id-provider , @elrondnetwork/erdjs-network-providers , @json-rpc-tools/blockchain , @json-rpc-tools/provider , @keplr-wallet/cosmos , @keplr-wallet/types , @keplr-wallet/unit , @microsoft/dev-tunnels-management , @portis/web3 , @sats-connect/make-default-provider-config , @taquito/michelson-encoder , @taquito/rpc , @taquito/signer , @taquito/tzip16 , AngularJS , Laravel , React , Vue , account-sdk , adal-node , ag-charts , ai-sdk-harness-cline , ai-sdk-js , airgap-beacon-dapp , airgap-beacon-sdk , airgap-beacon-transport-matrix , airgap-beacon-wallet , allure-axios , allure-codeceptjs , alpaca-coin-module , amplify-js , analogjs-storybook-angular , analogjs-vite-plugin-angular , analytics-node , angular-devkit-build-angular , angular-devkit-build-webpack , apify-client , appium , appium-adb , appium-base-driver , appium-base-plugin , appium-chromedriver , appium-coresim , appium-execute-driver-plugin , appium-fake-driver , appium-fake-plugin , appium-ios , appium-ios-device , appium-ios-remotexpc , appium-ios-simulator , appium-relaxed-caps-plugin , appium-remote-debugger , appium-support , appium-xcode , appkit , aptos-labs-wallet-adapter-core , aptos-ts-sdk , arizeai-openinference-instrumentation-beeai , aws-amplify , aws-amplify-api , aws-amplify-api-rest , aws-cdk , aws-crt-nodejs , aws-sdk-crc64-nvme-crt , aws-sdk-js-v3 , aws-sdk-signature-v4-crt , aws-sdk-util-user-agent-node , axe-core-cli , axios , axios-cache-adapter , axios-cookiejar-support , axios-ntlm , axios-rate-limit , axios-retry , babel-plugin-remove-graphql-queries , base44-sdk , basehub , beeai-framework , blockchain-link-utils , bluelovers-axios-extend , botbuilder-js , browser-sync , callstack-repack , callstack-repack-plugin-expo-modules , callstack-repack-plugin-nativewind , callstack-repack-plugin-reanimated , casper-js-sdk , cdp-sdk , celo-celocli , celo-dev-utils , celo-wallet-ledger , centra , chain-jslib , chain-jslib-nextgen , chat-adapter-slack , chat-adapter-teams , chromedriver , cldr-data , cldr-data-downloader , clients , cline , cline-llms , cline-sdk , cloud-sdk-js , codeceptjs , codesmith , coin-modules , configure , confluent-kafka-javascript , contentful-management , contentful-react-apps-toolkit , contentful.js , copilotkit-agentcore-runner , copilotkit-channels , copilotkit-channels-intelligence , copilotkit-channels-slack , copilotkit-runtime , copilotkit-sqlite-runner , copilotkit-voice , cosmjs , create-nx-plugin , create-nx-workspace , create-react-app , create-strapi , create-strapi-app , crystal , daytona , daytona-sdk , daytona-toolbox-api-client , daytonaio-api-client , daytonaio-sdk , deepeval , developer-tooling , device-sdk-ts , discuz-api , dmzj-api , docsearch , docusaurus , docusaurus-core , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-search-local , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , ecosystem , eip1193-provider , electron-webpack , ember-cli , envelop-newrelic , esjzone-api , ethersproject-cli , ethersproject-tests , expo , expo-ads-admob , expo-ads-facebook , expo-app-auth , expo-auth-session , expo-av , expo-barcode-scanner , expo-brightness , expo-calendar , expo-camera , expo-cli , expo-config , expo-config-plugins , expo-constants , expo-contacts , expo-dev-server , expo-dev-tools , expo-document-picker , expo-electron-adapter , expo-expo-cli , expo-file-system , expo-google-app-auth , expo-image-picker , expo-image-utils , expo-linking , expo-local-authentication , expo-location , expo-media-library , expo-metro-config , expo-next-adapter , expo-notifications , expo-optimize , expo-payments-stripe , expo-pwa , expo-screen-orientation , expo-sensors , expo-task-manager , expo-updates , expo-webpack-config , expo-xdl , expo-yarn-workspaces , extrareqp2 , fcl-js , firecrawl , follow-redirects , forge , fumadocs , gateway , gatsby , gatsby-cli , gatsby-cypress , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sharp , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , gcp-metadata , gitee-api , google-api-nodejs-client , google-auth-library , googlemaps-google-maps-services-js , gp-js-client , grafserv , graphql-hive-gateway , graphql-mesh-plugin-newrelic , grunt-karma , gtoken , hardhat , hey-api-client-axios , honeycomb-opentelemetry-js , http-proxy , http-proxy-middleware , http-server , ibm-cloud-sdk-core , ibm-cloud-watsonx-ai , imgbb , inertiajs-core , inertiajs-react , inertiajs-svelte , inertiajs-vue3 , ionic-v1-toolkit , izari-filecoin , jest-dev-server , jest-expo , jest-expo-enzyme , jest-process-manager , jest-puppeteer-pkg , jimp , jimp-core , jimp-plugin-blit , jimp-plugin-blur , jimp-plugin-circle , jimp-plugin-color , jimp-plugin-contain , jimp-plugin-cover , jimp-plugin-crop , jimp-plugin-displace , jimp-plugin-dither , jimp-plugin-fisheye , jimp-plugin-flip , jimp-plugin-mask , jimp-plugin-print , jimp-plugin-resize , jimp-plugin-rotate , jimp-plugin-threshold , jimp-types , karma , karma-browserstack-launcher , karma-jasmine , karma-junit-reporter , karma-mocha-reporter , karma-requirejs , km.js , langchain-anthropic , langchain-community , ledger-cosmos-js , ledger-live , ledgerhq-coin-algorand , ledgerhq-coin-aptos , ledgerhq-coin-bitcoin , ledgerhq-coin-canton , ledgerhq-coin-celo , ledgerhq-coin-concordium , ledgerhq-coin-cosmos , ledgerhq-coin-framework , ledgerhq-coin-icon , ledgerhq-coin-internet_computer , ledgerhq-coin-mina , ledgerhq-coin-module-boilerplate , ledgerhq-coin-near , ledgerhq-coin-polkadot , ledgerhq-coin-solana , ledgerhq-coin-stacks , ledgerhq-coin-stellar , ledgerhq-coin-sui , ledgerhq-coin-tester , ledgerhq-coin-tester-bitcoin , ledgerhq-coin-tester-solana , ledgerhq-coin-tester-tron , ledgerhq-coin-tezos , ledgerhq-coin-ton , ledgerhq-coin-tron , ledgerhq-coin-xrp , ledgerhq-context-module , ledgerhq-device-core , ledgerhq-device-management-kit , ledgerhq-device-signer-kit-ethereum , ledgerhq-device-signer-kit-solana , ledgerhq-device-transport-kit-mockserver , ledgerhq-device-transport-kit-node-hid , ledgerhq-device-transport-kit-react-native-hid , ledgerhq-device-transport-kit-web-hid , ledgerhq-domain-service , ledgerhq-evm-tools , ledgerhq-hw-app-elrond , ledgerhq-hw-app-eth , ledgerhq-hw-app-exchange , ledgerhq-hw-app-multiversx , ledgerhq-hw-app-sui , ledgerhq-hw-app-vet , ledgerhq-ledger-key-ring-protocol , ledgerhq-live-cli , ledgerhq-live-common , ledgerhq-live-countervalues , ledgerhq-live-countervalues-react , ledgerhq-live-network , ledgerhq-live-nft , ledgerhq-live-nft-react , ledgerhq-live-signer-concordium , ledgerhq-live-wallet , ledgerhq-signer-utils , ledgerhq-speculos-device-controller , ledgerhq-speculos-transport , ledgerhq-wallet-btc , ledgerhq-wallet-pnl , ledgerjs , lerna , lg-tools-cli , lg-tools-slackbot , load-bmfont , localtunnel , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , lynx-js-rspeedy , magic-js , mailcomposer , mailgun.js , manifest , masiro-me-api , mastra , mastra-blaxel , mastra-code-sdk , mastra-connect , mastra-daytona , mastra-deepeval , mastra-factory , mastra-playground-ui , mastra-slack , mastra-tavily , mastra-teams , mastracode , mdx , medplum-bot-layer , mem0-openclaw-mem0 , mem0ai , mendable-firecrawl-js , metamask-accounts , metamask-core , microsoft-365-agents-toolkit , microsoft-teams.api , microsoft-teams.common , microsoft-teams.graph , modern-js-adapter-rstest , modern-js-app-tools , modern-js-generator-utils , modern-js-server , modern.js , module-federation-cli , module-federation-core , module-federation-dts-plugin , module-federation-enhanced , module-federation-modern-js , module-federation-native-federation-typescript , module-federation-nextjs-mf , module-federation-rsbuild-plugin , module-federation-rspack , module-federation-storybook-addon , module-federation-typescript , module-federation/core , multiversx-sdk-core , mysten-deepbook-v3 , mysten-docs , mysten-enoki , mysten-ledger-signer , mysten-ledgerjs-hw-app-sui , mysten-signers , mysten-walletconnect-wallet , nango , nestjs-axios , netlify-opentelemetry-sdk-setup , newrelic-security-agent , nguniversal , node , node-newrelic , node-newrelic-aws-sdk , node-newrelic-koa , node-newrelic-superagent , node-novel-cached-lhscan , node-novel-site-cache-util , node-potrace , node-vault , nodemailer , nomicfoundation-hardhat-ethers , notifications-node-client , npm:@aptos-labs/aptos-client , npm:@browserstack/ai-sdk-node , npm:@celo/hw-app-eth , npm:gatsby-theme-blog-core , nx , nx-angular , nx-detox , nx-devkit , nx-eslint , nx-expo , nx-jest , nx-js , nx-module-federation , nx-next , nx-react , nx-react-native , nx-rollup , nx-rspack , nx-vite , nx-vitest , nx-vue , nx-web , nx-workspace , octanejs-docusaurus , office-addin-debugging , office-addin-dev-settings , onflow-fcl-rainbowkit-adapter , open-wc-testing-karma , open-wc-testing-karma-bs , openapitools-openapi-generator-cli , opencensus-node , opentelemetry-sampler-jaeger-remote , orama-orama , parcel-reporter-zephyr , pgl , phin , phpwind-api , pm2 , pocket-js , polkadot-hw-ledger , porto , postgraphile , privy-io , rainbowkit , reown-appkit , reown-appkit-adapter-bitcoin , reown-appkit-adapter-ethers , reown-appkit-adapter-ethers5 , reown-appkit-adapter-solana , reown-appkit-adapter-wagmi , reown-appkit-experimental , reown-appkit-pay , reown-appkit-scaffold-ui , reown-appkit-siwe , reown-appkit-siwx , reown-appkit-universal-connector , reown-appkit-utils , reown-appkit-wallet-button , repack , restful-decorator , retry-axios , rock-js-plugin-repack , rollup-plugin-zephyr , rsdoctor , rsdoctor-components , rsdoctor-core , rsdoctor-rspack-plugin , rsdoctor-webpack-plugin , rspack-cli , rspack-dev-server , rules_nodejs , ruru , rushstack-heft-rspack-plugin , rushstack-heft-vscode-extension-rig , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , rushstack-heft-webpack5-plugin , safe-global-testing-kit , sap-ai-provider , sap-ai-sdk-core , sap-ai-sdk-document-grounding , sap-ai-sdk-foundation-models , sap-ai-sdk-orchestration , sap-ai-sdk-prompt-registry , sap-ai-sdk-rpt , sap-cloud-sdk-http-client , sap-cloud-sdk-openapi , sap-cloud-sdk-resilience , sap-cloud-sdk-util , sats-connect , sats-connect-core , sdk-typescript , secretjs , sendgrid-nodejs , sentry-gatsby , sentry-solidstart , size-plugin , skia-canvas , slack-bolt , slack-oauth , slack-socket-mode , slack-web-api , smooth-code/jest-puppeteer , soap , solana-program-library , solana-wallet-adapter-example , solc , solidjs-start , sonarqube-scanner , start-server-and-test , stellar-sdk , stellar-stellar-sdk , storybook-angular , storybook-preset-create-react-app , strapi-admin , strapi-cloud-cli , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-core , strapi-email , strapi-i18n , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-email-mailgun , strapi-provider-email-sendgrid , strapi-review-workflows , strapi-strapi , strapi-upload , strong-globalize , strong-globalize-cli , strong-remoting , stx-labs-stacks.js , stx-labs/stacks.js , swagger-api-apidom-ls , swagger-api-apidom-reference , swagger-js , swagger-ui , syosetu-api , tanstack-ai-sandbox-blaxel , tanstack-ai-sandbox-daytona , taquito , taquito-beacon-wallet , taquito-http-utils , taquito-ledger-signer , taquito-remote-signer , taquito-taquito , taquito-tzip12 , tas-client , tavily-core , teams.ts , testem , theme-ui , ton-ton , trezor-connect-web , trezor-suite , tronwallet-adapter , tronweb , tronweb3-tronwallet-adapter-binance , tronweb3-tronwallet-adapter-bitkeep , tronweb3-tronwallet-adapter-metamask-tron , tronweb3-tronwallet-adapter-walletconnect , tronweb3-walletconnect-tron , ts-sdks , turbo-codemod , twilio , typesense-js , ui-extensions-sdk , vechain-sdk-js , vercel-client , vercel-microfrontends , vespaiach-axios-fetch-adapter , viem-anvil , vinxi , vinxi-router , vinxi-server-components , vinxi-server-functions , vite-plugin-tanstack-start-zephyr , vite-plugin-vinext-zephyr , vite-plugin-zephyr , wagmi , wagmi-connectors , wait-on , wallet-adapter , walletconnect-ethereum-provider , walletconnect-monorepo , wdio-browserstack-service , web3-react , web3.js , webpack-dev-server , webpack-plugin-serve , wenku8-api , wikipedia , wordpress-scripts , ws-rest , x402 , x402-paywall , xdl , zbsearch-plugin-docusaurus , zephyr-agent , zephyr-astro-integration , zephyr-metro-plugin , zephyr-modernjs-plugin , zephyr-nuxt-module , zephyr-packages , zephyr-repack-plugin , zephyr-rolldown-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-webpack-plugin , zephyr-xpack-internal , zmarkdown , zondax-ledger-filecoin , zondax-ledger-substrate

Affected packages:

follow-redirects @ 1.16.0 (+8315 more)