30 matches found
follow-redirects: follow-redirects: Information disclosure via cross-origin redirects
A flaw was found in follow-redirects, which can lead to information disclosure. The library improperly validates the sensitiveHeaders configuration option when handling header lists defined across different execution contexts, causing the list of protected headers to be discarded. Consequently,...
follow-redirects: follow-redirects: Information disclosure via cross-origin redirects
A flaw was found in follow-redirects, which can lead to information disclosure. The library improperly validates the sensitiveHeaders configuration option when handling header lists defined across different execution contexts, causing the list of protected headers to be discarded. Consequently,...
follow-redirects: follow-redirects: Information disclosure via cross-origin redirects
A flaw was found in follow-redirects, which can lead to information disclosure. The library improperly validates the sensitiveHeaders configuration option when handling header lists defined across different execution contexts, causing the list of protected headers to be discarded. Consequently,...
follow-redirects: follow-redirects: Information disclosure via cross-origin redirects
A flaw was found in follow-redirects, which can lead to information disclosure. The library improperly validates the sensitiveHeaders configuration option when handling header lists defined across different execution contexts, causing the list of protected headers to be discarded. Consequently,...
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled...
npm: follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
npm: follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects vulnerability discovered by ? in WordPress npm follow-redirects versions = 1.16.0, = 1.16.1...
GHSA-MRWP-F3Q8-3G9P follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empty list, so a caller-declared custom credential header can be forwarded to an attacker-controlled...
CVE-2026-116689
A flaw was found in follow-redirects, which can lead to information disclosure. The library improperly validates the sensitiveHeaders configuration option when handling header lists defined across different execution contexts, causing the list of protected headers to be discarded. Consequently,...
Linux Distros Unpatched Vulnerability : CVE-2026-116689
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders opti...
CVE-2026-116689
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though...
CVE-2026-116689 follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though...
CVE-2026-116689 follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though...
CVE-2026-116689 follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though...
CVE-2026-116689
The Node.js HTTP and HTTPS client wrapper follow-redirects versions 1.16.0 through 1.16.2 is vulnerable to a security flaw where sensitiveHeaders arrays created in different JavaScript realms are incorrectly discarded because the library uses instanceof Array instead of Array.isArray(). This allo...
follow-redirects information disclosure vulnerability
In versions 1.16.0 through 1.16.2 of follow-redirects, there is an information disclosure vulnerability. This vulnerability arises because the sensitiveHeaders option checks for an instance of an Array; as a result, arrays created in other JavaScript environments are replaced with an empty list...
SUSE CVE-2026-111755
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a...
follow-redirects sensitiveHeaders regex escaping can expose credential headers
Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653, which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single...
EUVD-2026-104536
follow-redirects sensitiveHeaders regex escaping can expose credential headers...
GHSA-8R9P-F939-6H3C follow-redirects sensitiveHeaders regex escaping can expose credential headers
Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653, which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single...
DEBIAN-CVE-2026-111755
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a...