Zero Radar
← feed
HighVulnerabilityCVE-2026-116689updated 30 Oct 2026, 23:00 UTC

follow-redirects leaks custom API keys to attacker sites on redirect

A popular Node.js library can accidentally send your custom secret header (like an API key) to a different website when the server redirects. Built-in login headers stay protected; only custom ones are at risk.

Fixed in follow-redirects 1.16.2 · out Official source
SeverityHighCVSS 8.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesfollow-redirects 1.16.2 · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker controls endpointServer returns a cross-origin redirect
  2. 2App sends requestCustom API key header included
  3. 3Library follows redirectsensitiveHeaders reset to empty list
  4. 4Header forwardedCustom credential sent to attacker host
  5. ResultAttacker receives your custom API key

What happened

In follow-redirects 1.16.0 and 1.16.1, the sensitiveHeaders option is validated with 'instanceof Array', which fails for arrays created in another JavaScript realm (e.g. node:vm). The option is then silently reset to empty, so custom credential headers are forwarded on cross-origin redirects.

Why it is dangerous: A custom credential such as an API key or service token listed in sensitiveHeaders can be sent to an attacker-controlled or compromised endpoint that issues a cross-origin redirect, exposing the secret until it is revoked.

Are you affected?

You are affected if you use follow-redirects 1.16.0 or 1.16.1 directly or through a wrapper, pass a custom credential header via sensitiveHeaders, and the array is created in another realm (for example via node:vm).

Package / productAffected versionsFixed in
follow-redirects · npm>= 1.16.0, <= 1.16.11.16.2

What to do

  1. Update follow-redirects to 1.16.2 or later
  2. Check whether your code or wrappers use the sensitiveHeaders option with custom credential headers
  3. Rotate any API key or token that may have been sent to a redirect target

Timeline

  1. 30 Oct 2026, 22:59 UTC
    Publicly disclosed
  2. 30 Oct 2026, 22:59 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 30 Oct 2026, 23:00 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116689 · GHSA-mrwp-f3q8-3g9p
CVSS
8.2 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
30 Oct 2026, 22:59 UTC
On Zero Radar
30 Oct 2026, 23:00 UTC (1 min after disclosure)
Last change
30 Oct 2026, 23:00 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

follow-redirects leaks custom API keys to attacker sites on redirect · Zero Radar