follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

[ Fixes ]Fixes and patches

• follow-redirects 1.16.2Fixed version · GitHub Advisories · npm package follow-redirects: upgrade to 1.16.2 or later (affected >= 1.16.0, <= 1.16.1)

[ Packages ]Affected open-source packages

• follow-redirects npmAffected >= 1.16.0, <= 1.16.1 · fixed in 1.16.2 · GHSA-mrwp-f3q8-3g9p

[ References ]References

• github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc8…
• github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2
• github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p