CVE-2026-40895: follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets
follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
follow-redirectsto a version that resolves this vulnerability.Fixed in 1.16.0
Event History
Frequently Asked Questions
What are the details of CVE-2026-40895?
CVE-2026-40895 identifies a vulnerability in the 'follow-redirects' NPM package that causes custom authentication headers to leak when following cross-domain redirects.
What is the severity of CVE-2026-40895?
CVE-2026-40895 has a moderate severity level due to its potential to expose sensitive information.
How do I fix CVE-2026-40895?
To fix CVE-2026-40895, upgrade the 'follow-redirects' package to version 1.16.0 or later.
Which versions of 'follow-redirects' are affected by CVE-2026-40895?
CVE-2026-40895 affects all versions of 'follow-redirects' prior to 1.16.0.
What types of redirects are involved in CVE-2026-40895?
CVE-2026-40895 involves HTTP responses with redirect status codes 301, 302, or 303.