# follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

follow-redirects used instanceof Array to validate sensitiveHeaders, so cross-realm arrays were dropped and custom credential headers leaked to cross-origin redirect targets.

- Payout: Research
- Severity: high
- Program: follow-redirects
- Found by: burythevalley
- Disclosed: 2026-10-30
- CVE: CVE-2026-116689
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-mrwp-f3q8-3g9p
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-mrwp-f3q8-3g9p
- Tags: area:oss domain:oss impact:data-leak kind:research platform:ghsa sev:high tech:nodejs technique:parser-differential technique:source-review vuln:info-disclosure vuln:misconfiguration

**Target:** npm HTTP client library redirect handling
**Root cause:** index.js validates options.sensitiveHeaders with a local isArray() helper using `value instanceof Array`, which is realm-dependent; arrays from another realm (e.g. node:vm) fail the check and are replaced with an empty list, disabling header stripping. The same file already uses Array.isArray for options.headers.
**Steps:**
1. Start two loopback HTTP servers; server A returns a 302 redirect to server B (cross-origin).
2. Create a cross-realm array: `const sensitiveHeaders = vm.runInNewContext(\`['X-API-Key']\`)`.
3. Send a request through follow-redirects with header `X-API-Key` and that sensitiveHeaders array.
4. Observe server B receives `X-API-Key` (same-realm array correctly strips it; unrelated `X-Harmless` remains in both cases).
**How found:** Noticed the file inconsistently used `Array.isArray(options.headers)` but a custom `instanceof Array` helper for sensitiveHeaders, hypothesized realm-identity failure, and tested with node:vm cross-realm arrays against loopback redirect servers.
**Exploitation:** Requires a caller or wrapper passing a cross-realm sensitiveHeaders array plus a custom credential header, and an attacker-controlled or compromised endpoint issuing a cross-origin redirect; the credential header is then forwarded to the redirect destination.
**Insight:** When a library mixes `Array.isArray` and `instanceof Array` for security-relevant options, the instanceof path is a realm-bypass candidate — test any option that gates secret stripping with node:vm-created arrays.

## Proof of concept (copied exactly from the original report)

**Cross-realm sensitiveHeaders array creation via node:vm**

```
const vm = require('node:vm');
const sensitiveHeaders = vm.runInNewContext(`['X-API-Key']`);
```