Log in Start free

Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-40895follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

High 7.5

In plain English

A high-severity information exposure in follow-redirects from follow-redirects. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 57.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-follow-redirectsno fix listedDEBIAN-CVE-2026-40895
Debian:13node-follow-redirectsno fix listedDEBIAN-CVE-2026-40895
Debian:14node-follow-redirects1.16.0+~1.14.4-1DEBIAN-CVE-2026-40895
Ubuntu:25.10node-follow-redirectsno fix listedUBUNTU-CVE-2026-40895
npmfollow-redirects1.16.0GHSA-r4q5-vmmm-2653

Affected products (as reported)

VendorProductVersions
follow-redirects follow-redirects < 1.16.0

Weakness: CWE-200, CWE-212 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References