Threats tagged 'ghsa-mrwp-f3q8-3g9p'

The follow-redirects library versions 1.16.0 and 1.16.1 contain a vulnerability where the sensitiveHeaders option is validated using instanceof Array, which fails for arrays created in different JavaScript realms. This causes the sensitiveHeaders array to be replaced with an empty list, allowing custom credential headers to be forwarded to attacker-controlled cross-origin redirect destinations. This can lead to disclosure of custom credential headers such as API keys. The issue is fixed in version 1.16.2.