GHSA-MRWP-F3Q8-3G9P follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled...