Insertion of Sensitive Information Into Sent Data Affecting follow-redirects package, versions >=1.16.0 <1.16.2
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-FOLLOWREDIRECTS-21762031
- published28 Oct 2026
- disclosed27 Oct 2026
- creditRob Jones
Introduced: 27 Oct 2026
NewCVE-2026-116689 (opens in a new tab)How to fix?
Upgrade follow-redirects to version 1.16.2 or higher.
Overview
Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the _sanitizeOptions function in index.js, which uses instanceof Array to validate the sensitiveHeaders option. An attacker who controls the sensitiveHeaders value can supply a cross-realm array (created in a separate VM context) that passes Array.isArray but fails the instanceof Array check, causing the guard to reset sensitiveHeaders to an empty array and allowing sensitive headers to be forwarded to a redirect target that should not receive them.
PoC
Start two loopback HTTP servers. The first returns a 302 redirect to the second. Send X-API-Key and list that name in sensitiveHeaders, then compare a normal array with a genuine cross-realm array created by:
const vm = require('node:vm');
const sensitiveHeaders = vm.runInNewContext(`['X-API-Key']`);
Observed against both source and the exact npm 1.16.1 package:
- Same-realm ['X-API-Key']: the redirect target did not receive the key.
- Cross-realm ['X-API-Key']: Array.isArray(value) was true, value instanceof Array was false, and the redirect target received X-API-Key.
- An unrelated X-Harmless header remained present in both cases.
The complete 3.5 KB loopback-only harness and raw JSON output are available privately.
Note: The PoC uses two loopback HTTP servers and a cross-realm array created via Node.js node:vm, tested against npm package version 1.16.1.